Last updated October 4, 2026 · Report an error
"Mixed content" happens when a page loaded securely over HTTPS also loads a sub-resource (image, script, stylesheet) over plain, insecure HTTP — browsers flag or outright block this. This tool scans an HTTPS page's raw HTML for src="http://" and href="http://" references, the most common real source of these warnings.
How it works
The page is fetched live and its HTML is scanned for src="http://…" and href="http://…" attribute references. This is a static-markup scan — it reads the HTML exactly as the server sent it, so URLs constructed dynamically by JavaScript at runtime aren't caught.
- Enter hTTPS page URL.
- Click Calculate to see your results.
Examples
A leftover insecure image reference
An <img src="http://cdn.example.com/logo.png"> tag on an otherwise fully-HTTPS page is a classic case — often left behind after a partial HTTP-to-HTTPS migration.
Who should use it
- Auditing a site after an HTTP-to-HTTPS migration for leftover insecure references.
- Ongoing security hygiene checks on a live HTTPS site.
Industry applications
- Web development and site migrations
- IT security and compliance audits
Advantages
- Same SSRF-guarded live-fetch approach used by this site's other website-scanning tools.
- Lists every distinct insecure reference found, not just a yes/no summary.
Limitations
- Static-markup scan only — won't catch mixed content generated dynamically by client-side JavaScript.
Common mistakes to avoid
- Assuming a clean scan result means zero mixed content — content injected dynamically by JavaScript after page load isn't visible to a static HTML scan.
- Fixing only the reported occurrences without searching your site's templates for the same hardcoded http:// reference reused elsewhere.
Best practices
- After migrating to HTTPS, scan every major page template (not just the homepage) since mixed content often hides in shared headers, footers, or widgets.
- Prefer protocol-relative or fully relative URLs for internal resources going forward, so they can never mismatch the page's own protocol again.
Tips
- Pair with the HSTS Checker and TLS Version Support Checker for a broader picture of a site's HTTPS health.