You’re pretty much on.
The behaviour depends on the browser in question, but in general I think you’re safe assuming:
- images will load (with a warning)
- other resources such as
.jsor.csswill refuse to load
If you want to be extra careful before forcing SSL, visiting Chrome’s net-internals page: chrome://net-internals/#hsts and adding your domain to the STS set will let your “preview” how your browser will behave with “Force SSL” enabled:
(presumably you can do this in other browsers, I just know off hand how to do it for Chrome)