Mixed content checker

What the mixed content checker does

This tool scans an HTTPS webpage and finds resources that are loaded over plain HTTP. It reports the mixed content resources it detects, such as scripts, stylesheets, images, or iframes referenced with an http:// URL.

Mixed content occurs when a secure page includes resources from an insecure source. Browsers treat this as a security concern because the insecure resource can be tampered with in transit, potentially compromising the entire page even though the main document was delivered securely.

Why mixed content matters

Browsers increasingly block or warn about mixed content. Active mixed content, such as scripts and stylesheets, is often blocked outright because it can execute code or alter the page. Passive mixed content, such as images, may display with a warning or be upgraded automatically. Either way, the result is a less reliable page.

Mixed content can also undermine user trust. A broken padlock icon or a security warning tells visitors that something is wrong, even if the main page is otherwise secure. For sites that handle sensitive information, this is especially damaging.

How to interpret the result

The tool lists resources referenced with insecure URLs. Review each one and determine whether it is essential. Common causes include hardcoded HTTP URLs in templates, third-party widgets that only offer HTTP endpoints, and content pasted from other sources with absolute URLs.

Check whether the resource is available over HTTPS. Often the same host supports both protocols, and switching the URL is enough. For third-party resources without HTTPS support, consider replacing them or hosting the resource locally. After fixes, re-run the check to confirm the page is clean.

Common mixed content sources

• Hardcoded HTTP URLs. Legacy templates and content that predate HTTPS.
• Third-party scripts and widgets. Embeds that use insecure endpoints.
• Images and media. Assets hosted on insecure domains.
• CSS imports. Stylesheets that pull in insecure fonts or backgrounds.
• User-generated content. Pasted HTML containing http:// links.

Practical workflow

Run the checker on key templates and content pages. Fix active mixed content first, since it is most likely to break functionality. Update hardcoded URLs, replace insecure third-party resources, and sanitize user content. Re-check after changes and monitor for new mixed content as features are added.

Limitations

The checker examines resource references in the HTML response. It may not detect resources loaded dynamically by scripts, and it does not determine how each browser will treat a specific mixed content case.