Bulk up to 100 • Basic scan • Finds http:// resources in HTML

Mixed Content Checker (Basic)

Paste HTTPS URLs — we’ll fetch the HTML, follow redirects, and detect insecure http:// scripts, images, styles, iframes, and more.

Paste up to 100 URLs/domains (one per line)
Tip: This is a basic HTML scan. Some mixed content appears only after JS renders the page.

Results

Host Page HTTP Hops Time Issues
Run a check to see results here.
“Mixed content” means an HTTPS page loads some resources over HTTP.

Quick interpretation

Mixed content can trigger browser warnings or blocked resources.

  • OK no insecure http:// resources found
  • Warning mixed content detected or non-HTML page
  • Error fetch errors, loops, HTTP 4xx/5xx
HTTPS hygiene

Mixed Content Checker: find insecure http resources on https pages

Even if a page uses HTTPS, a single http:// script, stylesheet, or image can create mixed content. Browsers may block those resources or show warnings. This basic checker fetches the HTML, follows redirects, and lists insecure URLs found in common attributes like src and href.

Common causes

  • Hardcoded http:// links to CDN assets or images.
  • Legacy embeds (iframes, scripts) that don’t support HTTPS.
  • Redirects where the final page or resource ends up on HTTP.

FAQ

What is “mixed content” and why is it a problem?

Mixed content happens when an HTTPS page loads any resource over http:// (images, scripts, CSS, iframes, fonts, media, etc.).

Browsers may block “active” mixed content (like scripts) and show warnings for “passive” mixed content (like images). Even one insecure request can reduce trust and break page functionality.

What exactly does this “Basic” checker scan?

This checker downloads a limited HTML snippet and searches for insecure http:// URLs in common places:

  • src / href / action / data attributes
  • <meta http-equiv="refresh"> redirects that point to http://
  • Inline CSS patterns like url(http://...)

It’s designed for fast bulk audits — not a full browser simulation.

Why can the tool miss mixed content that I see in the browser?

This tool does not execute JavaScript. If your page injects resources dynamically after load (via JS, tag managers, widgets), those URLs might not appear in the raw HTML snippet.

Also, if the insecure URL appears late in the HTML (beyond the fetch limit), it may be missed. Use this as a first-pass detector, then confirm in DevTools “Network” if needed.

Why do I get “not html” in results?

“Not HTML” means the response is likely XML/JSON/file content, or the content type doesn’t look like HTML. In that case, scanning HTML attributes (src, href, etc.) doesn’t apply.

Examples: APIs, feeds, sitemaps, PDF downloads, or image endpoints.

What does “redirected to http” mean?

Your input may be HTTPS, but the final URL after redirects ends on http://. That’s an HTTPS configuration problem (or a forced downgrade).

Fix by enforcing HTTPS at the server/CDN level (one-hop 301 to HTTPS) and updating any internal links that still point to HTTP.

How do I fix mixed content found by this tool?

Common fixes:

  • Replace http:// with https:// for assets (images/CSS/JS/fonts)
  • Update third-party embeds/widgets to HTTPS versions (or replace them)
  • Fix templates/CMS fields where old HTTP URLs are hardcoded
  • If a vendor doesn’t support HTTPS, host the asset yourself (if allowed)

After changes, re-run the tool and verify in a real browser network waterfall.

Does mixed content always break the page?

Not always, but it can. Browsers often block scripts loaded over HTTP on an HTTPS page (that can break tracking, UI widgets, and functionality).

Images may still load but can trigger warnings. Either way, it’s best practice to eliminate all insecure requests.

Why do I see “partial fetch (size limit)” and how to interpret it?

This tool fetches only the first part of the HTML to stay fast for bulk checks. If the response is large, it may hit the size cap and report “partial fetch”.

That means the scan is incomplete. If you suspect mixed content lives deeper in the markup, run a targeted check for that page (or increase the fetch limit in code).