Find the http scripts, styles, images and forms that break the padlock on an https page
Checked from our server in India. Only the address you type is sent to us; nothing else leaves your device. Checked against sources on 16 Oct 2026.A mixed content checker finds the plain http addresses an https page loads. This one fetches the page from our server and reads its markup for scripts, stylesheets, frames, images, media and form actions on http, then sorts them into the 3 groups browsers use: blocked outright, upgraded to https, or warned about before a form is sent.
Type the https address of the page.
Press Find mixed content.
Change each listed address to https, then check again.
An https page is only as secure as everything it loads. When it pulls a script, a stylesheet or an image over plain http, that part travels unencrypted and can be read or changed on the way. Browsers call this mixed content. They block the dangerous kind and show a weaker padlock, or a "Not secure" label, for the rest.
This checker fetches the page from our server, follows redirects, reads the first megabyte of the HTML and lists every http address in it, with the tag and attribute it came from: script src, link rel=stylesheet, iframe src, object data, img src and srcset, video, audio and source, url() in style attributes and <style> blocks, @import, and form action. Text inside scripts and comments is ignored.
The W3C Mixed Content standard sorts content into two groups. Blockable content, which is scripts, stylesheets, frames and plugins, is blocked outright, so the page loses that code or styling. Upgradeable content, which is images, audio and video, is requested over https instead; if the host has no https copy, it simply does not appear. A form that sends to an http address gets a warning before it is submitted.
The upgrade-insecure-requests directive, sent in a Content-Security-Policy header or meta tag, tells the browser to try https for every address. The checker notes when a page sends it; it helps only if every host listed also serves https.
Only the markup is read. Addresses written by JavaScript at run time, and those inside external stylesheet files, do not appear in the HTML; the browser console lists them when the page is opened.
Usually because the page loads something over plain http: an image, a script, a stylesheet or a form target. Browsers then weaken the padlock or block the item. Type the page address here and the checker lists every http address in the page markup, with the tag it came from, so you know what to change.
Change each listed address from http:// to https://, after checking that the other site serves the file over https. If it does not, host the file yourself or remove it. For addresses in a theme or plugin, change the setting that writes them, often the site address in the CMS settings.
Scripts, stylesheets, frames and plugins are blockable: browsers refuse to load them over http, so parts of the page break. Images, audio and video are upgradeable: browsers try the same address over https instead, and show nothing if that copy does not exist. Both should be fixed.
The upgrade-insecure-requests directive makes browsers request every http address over https, which fixes mixed content when each host already serves the same file on https. A host without https still fails. The checker notes when a page sends the directive, in its header or a meta tag, and still lists the addresses.
The checker reads the HTML our server receives. Addresses that JavaScript adds after the page loads, and those inside separate CSS files, are not in that HTML. Open the page with the browser developer tools console visible: it reports every blocked or upgraded request.
Yes. Whatever is typed, including passwords or card details, is sent unencrypted, even though the page itself was on https. Browsers show a warning before such a form is submitted. Point the form action at an https address.
Rates and rules change; check the source before you rely on a figure.
Still stuck? Ask about Mixed Content Checker and anybody who knows can answer. No account needed.
Same job, other tools: NS Lookup – Find the name servers a domain is delegated to, and how long resolvers cache them · SRV Record Lookup – Look up SRV records: priority, weight, port and target for a service · IP to ASN Lookup – Map an IP address to the ASN that announces it, with the BGP prefix · DNSKEY Lookup – List a zone’s DNSKEY records with key tags, KSK or ZSK roles, algorithms and key sizes.