also prevent http in scripts