Mixed Content Checker

The Mixed Content Checker inspects whether an HTTPS page loads insecure resources over plain http:// — images, scripts, stylesheets and more. Enter a URL and the server fetches the page's HTML, then scans the img, script, link, iframe, video, audio and source tags for any plaintext HTTP resource, listing each one by tag, address and total count.

Mixed content breaks the padlock icon, and modern browsers outright block active content such as scripts and stylesheets, which can break your layout or functionality. Run this tool before and after a deploy to make sure no plaintext links remain. A count of zero is healthy; any insecure resource is flagged as dangerous.

Why mixed content is dangerous

Even when the page body is delivered encrypted over HTTPS, any resource it pulls in over plain HTTP is exposed to interception and tampering. An attacker who swaps out a script in transit can compromise the whole page, so browsers treat mixed content as a security weakness.

• Active content (script, iframe, link[stylesheet]) is usually blocked outright.
• Passive content (img, video, audio) is blocked or shown with a warning.
• The padlock icon changes to "not secure" or a partially secure state.

How to fix it

The simplest fix is to change every resource URL to https://, or to use protocol-relative (//example.com/...) or root-relative (/assets/...) paths. If an external host has no HTTPS support, move the resource onto your own server or switch to a host that does. For bulk migration you can apply a temporary upgrade with the Content-Security-Policy: upgrade-insecure-requests header. Use the security headers checker to confirm that CSP and your other security headers actually landed in the response.

Browser behavior and fix by content type

The same plaintext HTTP resource is handled differently depending on what it is. Active content can directly manipulate the page, so browsers block it unconditionally; passive content still renders but drops the page's security state to "not fully secure." Use the table below to prioritize — it tells you at a glance which resources to fix first.

Worked example: one image breaks the padlock

Suppose a page served over https:// loads <img src="http://example.com/logo.png"> in its body. This checker catches that single line and reports it as "passive (image) · 1 plaintext HTTP resource." Because an image is not active content, it usually still renders, but the address-bar padlock immediately switches to "not fully secure." Here is how to read and fix it:

• Symptom — the image shows, but the padlock breaks and the console logs a "Mixed Content" warning.
• Cause — an HTTPS page loads http://example.com/logo.png (passive, plaintext).
• Fix — change the URL to https://example.com/logo.png. (The protocol-relative form //example.com/logo.png is deprecated now, so spell out https instead.)

If that same line were a script instead of an img, the browser would not render it at all and would block it outright — so whenever the scan surfaces active content, fix that first.