I just received a bug report about the infamous Internet Explorer Security Warning for one of the pages in our application that serves video content over HTTPS. After viewing the source I found the offender which turned out to be the codebase attribute set to http://www.apple.com/qtactivex/qtplugin.cab . < object id ="videoObject" classid ="clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B" codebase ="http://www.apple.com/qtactivex/qtplugin.cab" width ="330" height ="292"> < param name ="src" value ="https://securedomain/video.mp4" /> < param name ="controller" value ="true" /> < param name ="autoplay" value ="False" /> < param name ="scale" value ="aspect" /> < param name ="cache" value ="true"/> ...