Mixed content checker
Find every image, script, stylesheet and iframe that an https page still loads over plain http://, the reason browsers show “Not secure” or quietly block parts of your page.
Check a page
Reads the page's HTML (up to 2 MB). Resources added later by JavaScript aren't visible to this scan; check those in your browser's DevTools console.
Active vs passive mixed content
Browsers split insecure resources into two groups, following the W3C Mixed Content specification:
- Active (scripts, stylesheets, iframes, fonts, fetch/XHR, form targets): anything that can change the page. Chrome, Firefox and Safari block these outright on https pages, so a menu, a layout or a payment form silently breaks.
- Passive (images, audio, video): Chrome now tries to auto-upgrade these to https and blocks them if that fails; older browsers load them but drop the padlock.
How to fix it
- Change each
http://reference tohttps://and confirm the resource loads there (most CDNs and embeds support it). - For your own assets, use root-relative paths (
/images/logo.png) so they follow whatever protocol the page uses. - In a CMS, run a search-and-replace on the database for your old
http://yourdomain(WordPress: a tool like WP-CLI'ssearch-replace). - Add
Content-Security-Policy: upgrade-insecure-requestsas a safety net, not a substitute. - If a third party has no https version, host the file yourself or drop it.
Questions people ask
What is mixed content?
An https page that loads some of its resources (images, scripts, styles, iframes) over unencrypted http. The page is only as secure as its weakest resource, so browsers warn or block.
Why does my site say “Not secure” even though I have an SSL certificate?
Usually mixed content: the page is https but references an image or script by an http:// URL. Scan the page above to find which ones.
Does mixed content affect SEO?
Indirectly. Google uses HTTPS as a light ranking signal, and blocked scripts or styles can break how the page renders for both visitors and Googlebot.