Mixed Content Checker

About Mixed content checker

Mixed content happens when an HTTPS page loads scripts, images or other resources over plain http. This tool downloads the page, scans its HTML for such references and separates them into active items that browsers block and passive items that only trigger a warning. Use it to find out why a secure page looks broken.

How to use it

1. Enter the secure page address in the HTTPS page URL field.
2. Select Scan Page. The address is sent to our server, which downloads the HTML.
3. Read the headline to see whether active or passive mixed content was found.
4. Work through the Active table first, then the Passive table, noting each element and insecure URL.
5. Change those references to https:// or remove them, then scan again.

One blocked script, two passive items

A page containing a script from http://cdn.example.com/a.js, an image from http://example.com/i.png, and a CSS font from http://f.com/x.woff.

Active: script src http://cdn.example.com/a.js. Passive: img src http://example.com/i.png and css url() http://f.com/x.woff. A protocol-relative image starting with // and an ordinary link to another http site are not listed.

When to use it

• Diagnosing a missing padlock or a broken layout after moving a site to HTTPS.
• Hunting down hard-coded http:// image links left in old blog posts.
• Checking a third-party widget before adding it to a secure page.
• Reviewing a template change to confirm no insecure resource sneaked back in.

Questions about Mixed content checker

What is the difference between active and passive?

Active content can run or restyle the page, such as scripts, iframes, stylesheets and form actions, so browsers block it. Passive content is displayed only, such as images, media and fonts, so browsers load it with a warning.

Does the tool request the insecure files it finds?

No. It only parses the HTML returned by the page. It never fetches the discovered addresses, so it cannot confirm whether those resources still exist.

Why did it miss something my browser reported?

Resources added by JavaScript after the page loads do not appear in the raw HTML, so they are invisible to this scan. Your browser console reports those as they happen.

Why does an http link not count?

A normal link is navigation, not a sub-resource. Browsers do not treat clicking a link to an http site as mixed content, so anchors are ignored.

What if the page is very large?

Only the first two megabytes of the response are read. If the page was cut off, a Page was truncated notice tells you that later references may not have been scanned.

Related tools

• HSTS preload checkerCheck whether a domain meets the HSTS preload eligibility criteria.
• Password Strength CheckerCheck the strength of a password
• Safe URL CheckerCheck if a URL is safe to visit
• Meta Tags CheckerCheck meta tags on a webpage
• File MIME Type CheckerCheck the MIME type of a file
• Gravatar CheckerCheck if an email has a Gravatar