When I moved my message board to HTTPS, we had mixed content warnings on avatars. After adding a Content-Security-Policy header to upgrade insecure requests, we

When I moved my message board to HTTPS, we had mixed content warnings on avatars. After adding a Content-Security-Policy header to upgrade insecure requests, we found that most sites without HTTPS failed quickly. But five or six people had domains that would "load" for 10+ seconds before finally timing out. Which had the effect of making forum topic pages take 10+ seconds to stop showing the "page loading" animation. Any site lacking HTTPS should instantly close connection attempts on port 443. But some it seems choose not to respond at all, making the browser unsure if the site is just slow or if an HTTPS service doesn't exist.