This meta tag must exist in the head of the your app's home page and must exist at the time that the document fires its load event. This is the only time you can turn on this feature and after you set it, it remains in effect until the next time the app is started. This means that iframe elements in your start page that point to HTTP URIs may load if the iframe exists and begins to load before the document finishes loading.
!DOCTYPE html> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>HTTPS connections example</title> <!-- Only use HTTPS connections. --> <meta name="ms-https-connections-only" content="true"/> <!-- WinJS references --> <link href="//Microsoft.WinJS.2.0/css/ui-light.css" rel="stylesheet"> <script src="//Microsoft.WinJS.2.0/js/base.js"></script> <script src="//Microsoft.WinJS.2.0/js/ui.js"></script> <!-- Your other script and style references. --> </head> <body> <!-- Your content. --> </body> </html>