Mixed Content Checker

Paste an HTTPS page's URL to find every image, script, stylesheet, or iframe it still loads over insecure http:// — the kind of leftover reference a migration to HTTPS often misses. Free, instant, no signup.

What this checks & how to fix it

It fetches the page and scans its rendered HTML for every element that loads an external resource — images, scripts, stylesheets, iframes, video, audio, and form targets — then checks whether any of those URLs use http:// while the page itself is served over https://. Each hit is labeled active or passive depending on how seriously browsers treat it.

How to fix what it finds

Almost always, the fix is changing the URL's protocol from http:// to https:// — most resources are already reachable both ways, since most of the web moved to HTTPS years ago. For a resource with no HTTPS version available, the safest options are switching to a protocol-relative URL, self-hosting the file, or replacing it with an HTTPS source entirely.

Frequently asked questions

What's the actual difference between "active" and "passive" mixed content?

Active content — scripts, stylesheets, iframes, form submissions — can read or alter the page, so a network attacker intercepting it over plain http:// could tamper with your site. Browsers refuse to load it at all on an HTTPS page. Passive content — images, video, audio — can only be seen, not altered, so browsers still load it but downgrade the page's security indicator to warn visitors.

Why did my SSL Certificate Checker pass but this still finds issues?

Those check two different things. The SSL Certificate Checker verifies the certificate itself — is it valid, who issued it, when does it expire. This tool checks what the page loads once that secure connection is established — a perfectly valid certificate doesn't stop a page from linking to an http:// image.

Does mixed content actually hurt SEO?

Not as a direct ranking factor, but indirectly, yes — Chrome and other browsers show a visible "Not secure" warning for pages with mixed content, which erodes visitor trust and can raise bounce rate. Active mixed content is worse: a blocked script or stylesheet can silently break page functionality that Googlebot also fails to render correctly.

I fixed the http:// links — why does the checker still show an old result?

Run the check again after the fix is live. Each check re-fetches the current page rather than reusing a stale result.

The URL I entered redirects from http to https — does that count?

No — this checks the final page after any redirect. It only flags resources the page itself references over http:// once it has finished loading over https://.

Related tools

Redirect Chain CheckerSitemap ValidatorRobots.txt GeneratorRobots.txt Checker

Command Palette

Search for a command to run...