Mixed Content Checker
Paste an HTTPS page address. The checker reads its HTML and lists every resource still referenced over http://, grouped into active content browsers block and passive content they warn about, with the exact tag and attribute to fix.
How to use it
- Paste the page address. The page must be served over https for mixed content to exist.
- Press Find mixed content. The HTML is fetched from our server and every src, href, srcset, poster, data and inline CSS url() is inspected.
- Fix the active items first (scripts, styles, iframes): browsers block those and the page breaks. Then the passive ones.
Why a page can be encrypted and still unsafe
Moving a site to HTTPS encrypts the document, but every image, script and stylesheet is its own request with its own scheme. One http:// script tag is enough for a browser to block the script, break whatever depended on it, and show a warning instead of a padlock. Old post content is the usual source: images inserted years ago with the full http:// address, embeds copied from another site, a theme option that still holds the old URL.
The checker inspects the served HTML, resolves every reference against the page, and reports the http:// ones with the tag and attribute they live in, so each fix is a known line rather than a search.
Mixed content FAQ
What is mixed content?
An HTTPS page that loads some of its parts over plain HTTP. The page itself is encrypted, but an attacker on the network can read or replace those parts. Browsers treat two kinds differently: active content (scripts, stylesheets, iframes, fetch and XHR targets) is blocked outright, which breaks the page; passive content (images, audio, video) is loaded with a warning and the padlock is downgraded.
The checker found http:// images but the site still shows a padlock. Why?
Modern browsers auto-upgrade passive content: Chrome and Firefox silently try the https:// version of an http:// image and only fall back to a warning when that fails. The page still has mixed content in its HTML, which other clients, crawlers and older browsers see, and it depends on the image host supporting HTTPS. Fix the markup anyway.
How do I fix mixed content on WordPress?
Most of it is old absolute URLs in post content and widgets. Set the site address to https in Settings, then run a search-and-replace from http://yourdomain to https://yourdomain in the database (WP-CLI search-replace or a plugin). Hard-coded http:// links in the theme need editing in the theme. A Content-Security-Policy upgrade-insecure-requests header fixes it at the browser without touching content.
Does the checker see content added by JavaScript?
No. It reads the HTML the server sends and the inline style attributes and style blocks in it. Resources injected by scripts after load, or defined in external CSS files, are outside the fetch. For those, open the browser console on the page: it lists every blocked or upgraded request.
Is a protocol-relative URL (//cdn.example.com/x.js) mixed content?
No. It takes the scheme of the page, so on an HTTPS page it loads over HTTPS. It is only flagged here as a note because absolute https:// is the clearer modern form.
More free tools: SSL Checker · Security Headers Checker · Redirect Checker · HTTP Status Checker