Mixed Content Checker

The Mixed Content Checker is a free tool that scans any public HTTPS page and finds every resource — images, scripts, stylesheets, iframes, and more — still being requested over plain, unencrypted HTTP. Browsers flag this directly to visitors, either by blocking the resource entirely or by showing a broken-lock warning next to your URL.

Mixed content tends to creep in quietly: a widget embedded years ago, a CDN link copied from an old snippet, a background image referenced with its original http:// URL. Each one chips away at the trust signal HTTPS is supposed to provide. Running this checker on a page surfaces every one of them at once, so you can fix the URLs before a visitor — or a browser's own warning — notices first.

When you submit a URL, the tool first confirms whether the page itself loads over HTTPS — mixed content only applies to a page that's already secure. It then fetches the page's live HTML and inspects every image, script, stylesheet, iframe, video, audio, embed, and object tag, along with url() references inside inline styles and <style> blocks, for any that point to a plain http:// address.

Each unique HTTP resource is listed once, along with the tag it came from, so you can see exactly what type of resource needs fixing and where it appears in the page.

• Fix scripts and stylesheets first — browsers block active mixed content like these outright, so a single HTTP script can silently break page functionality for every visitor.
• Passive mixed content, like images and video, still triggers a browser warning even though the resource loads. Update these too, not just the ones that get blocked.
• The simplest fix is usually swapping http:// for https:// in the resource URL — most third-party services have supported HTTPS for years, so the fix rarely needs a different provider.
• Re-check after any redesign or new integration. A single new widget or embed added later can quietly reintroduce mixed content on a page that was previously clean.