Mixed Content Checker
Find http:// scripts, styles, images and iframes on an HTTPS page, forms that post to http:// and password fields on insecure pages.
This is one of our 170+ checks.
Run the full audit: performance, security, SEO and AI readiness in one report, free and without sign-up.
Run the full audit →What the Mixed Content Checker checks
Mixed content happens when a page loaded over HTTPS includes resources over plain HTTP. Active mixed content (scripts, stylesheets, iframes) can change the whole page; passive mixed content (images, audio, video) can only change what it displays.
This checker reads the HTML of the URL you enter and lists every http:// resource it references, split into active and passive. It also flags forms whose action submits to an http:// address, and password fields on pages served without HTTPS. It works from the delivered HTML, so resources added later by JavaScript are not included.
Why it matters
Anything loaded over HTTP can be read or altered by anyone on the network path, such as a public Wi-Fi operator. An attacker who changes one HTTP script controls the page, which is why browsers block active mixed content outright. For images, audio and video, current browsers try to upgrade the request to HTTPS and block it if that fails, so the visible symptom is often a broken image rather than a warning.
Forms are worse: a login or checkout form on an HTTPS page that posts to HTTP sends the data unencrypted, and browsers warn users as they type. See our guides to mixed content and insecure forms.
How to fix common problems
Change the references to https://. Most CDNs and third-party services have supported HTTPS for years, so the fix is usually a find-and-replace in templates, theme settings and the database. In WordPress, a search-replace of http://example.com with https://example.com across the database fixes old post content.
For resources on your own domain, use root-relative paths such as /images/logo.png. If a third party has no HTTPS version, host the file yourself or replace the service.
As a safety net, send Content-Security-Policy: upgrade-insecure-requests, which tells browsers to request every subresource over HTTPS. It does not fix resources that are only available over HTTP, so clean up the source as well. Point every form action at an HTTPS URL. The full PerfoMetrix audit checks mixed content alongside HTTPS, HSTS, cookies and 170+ other checks.
Questions
Why does my site have no padlock even though it uses HTTPS?
Mixed content is the usual cause. One HTTP image or script is enough for the browser to show a warning or remove the secure indicator.
Does this check every page on my site?
No. It checks the page you enter. Mixed content often appears on specific templates, such as old blog posts, so test a few representative pages.
Are protocol-relative URLs like //cdn.example.com a problem?
On an HTTPS page they load over HTTPS, so they are not mixed content. Writing https:// explicitly is still clearer.
Related tools
Security Headers Checker
Test HSTS, Content-Security-Policy, clickjacking protection and other HTTP security headers, and get an A+ to F grade with exact fixes.
SSL Certificate Checker
Check certificate validity, days to expiry, hostname match, TLS version, key strength and the HTTP to HTTPS redirect for any domain.
Redirect Checker
Trace every redirect hop with its status code, spot long chains, temporary redirects and HTTPS downgrades, and test http:// and www variants.
Core Web Vitals Checker
Measure LCP, CLS, INP and the Lighthouse performance score for any URL, with real-user Chrome data when your page has enough traffic.