Mixed Content Checker
Find the HTTP resources that quietly remove the padlock from an HTTPS page.
The page to audit
How this check works
The page is fetched and every subresource in the markup is checked for an http:// address. The distinction the result leads with is active against passive, because they fail completely differently. Active content — scripts, stylesheets, iframes, form targets — can rewrite the page, so browsers block it outright and the breakage is obvious. Passive content — images, audio, video — is usually upgraded or shown with a warning, so the page keeps working and the padlock quietly disappears. That second case is the one people spend an afternoon hunting, and it is exactly the URLs listed here.
What the results mean
- Active content
- Scripts, stylesheets, iframes and form actions over HTTP. Blocked by every current browser, so whatever depended on them is missing.
- Passive content
- Images and media over HTTP. Usually upgraded or displayed with a warning — the page looks fine and the connection is no longer marked secure.
- Form action
- A form on a secure page posting to an insecure address. Browsers warn on submission, and the data really does travel unencrypted.
- Not found in the markup
- Only means nothing is declared in the HTML. Scripts that fetch insecure resources later will not appear here.
Common problems and fixes
- The browser says mixed content and this finds none
- The resource is being requested by JavaScript after the page loads. The browser console lists those; this reads the delivered markup.
- My images load anyway
- Browsers upgrade insecure images to HTTPS where they can. It works until the host does not support HTTPS, and the padlock is affected either way.
- I fixed the HTML and it still warns
- Check stylesheets for background images with http URLs, and any third-party embed that builds its own URLs. Both are common and neither is in the page source.
- A third-party widget is the culprit
- Most vendors serve over HTTPS and the embed code on the page is simply old. Take the current snippet from the vendor rather than editing the protocol by hand.
Frequently asked questions
What is mixed content?
A page served over HTTPS that loads some of its resources over plain HTTP. The page itself is encrypted and those resources are not, so they can be read or altered in transit — which is why browsers block the dangerous kinds and mark the connection as no longer fully secure.
Why does my padlock disappear on some pages?
Almost always one insecure image, font or media file. Browsers do not block passive content the way they block scripts, so the page looks completely normal and the only symptom is the changed padlock. Finding it by eye is miserable; it is one of the resources listed above.
Can I fix mixed content with a redirect?
Not reliably. A redirect from HTTP to HTTPS on your own server fixes your own resources, and does nothing for a third-party host that does not support HTTPS. Upgrade-insecure-requests in a Content-Security-Policy is the blunt instrument that covers both, at the cost of breaking resources that genuinely have no secure version.