Book a demo Start free

Mixed Content Checker

Enter any HTTPS URL and scan the page for scripts, stylesheets, images, iframes, and links still loaded over http://. Mixed content breaks the padlock, trips browser warnings, and can block scripts entirely.
Technical SEO Intelligence
A single HTTP script on an HTTPS page triggers the browser's "not secure" warning.
Browsers block active mixed content (scripts, stylesheets, iframes) outright. Passive content (images) loads but trips the warning. Both tank user trust. This tool scans your page and groups findings by category so you can prioritise fixes.
URL
How to fix
  1. Change http:// to https:// in your templates for every flagged resource. Many URLs now have HTTPS versions.
  2. Use protocol-relative URLs (//example.com/path) if your resource may be served over HTTP in dev environments.
  3. Add a Content-Security-Policy header with upgrade-insecure-requests to auto-upgrade mixed content.
  4. Scan again after changes to confirm clean.
Next steps
Pair with SSL expiry monitoring
A clean HTTPS page is only clean while the certificate is valid. Set up SSL expiry alerts.
SSL Certificate Checker
Frequently asked questions
What is mixed content?
An HTTPS page that loads subresources (scripts, images, styles, iframes) over HTTP. Browsers block "active" mixed content (JS, CSS) and warn on "passive" (images).
Why is mixed content a problem?
Breaks the page in modern browsers (Chrome blocks since 2020). Also a security issue: HTTP resources can be tampered with in transit.
How does the tool find mixed content?
Fetches the HTTPS page via Worker and parses the HTML for http:// references in src, href, and inline styles.
Does it catch runtime-injected mixed content?
No. Resources added by JavaScript after page load aren't in the static HTML. Combine with a browser audit (Chrome DevTools and Issues).
How do I fix mixed content?
Change http:// to https:// in CMS templates. If a third-party resource has no HTTPS version, replace or self-host over HTTPS.
What about protocol-relative URLs (//)?
Modern browsers prefer explicit https://. Protocol-relative is legacy and some crawlers mishandle it.
Does mixed content affect SEO?
Indirectly. Users see a "Not Secure" warning, bounce rate rises, Google favours fully-secure sites.
Can Content-Security-Policy fix mixed content?
upgrade-insecure-requests in CSP auto-upgrades http:// to https:// at browser load. Patch for legacy, not a long-term fix.
What are the most common sources of mixed content?
Hardcoded CDN URLs from before HTTPS migration, image URLs in rich-text content, third-party widgets with no HTTPS variant.
Is iframe mixed content serious?
Yes. Chrome blocks mixed-content iframes outright.
How often should I audit?
After every migration and quarterly as hygiene.
Free · no account

SEORCE for Chrome, Edge and Firefox

Audits the page you are on: headings, meta tags, schema, indexability, and whether AI crawlers can read it. Export the result as a PDF. Free, with no account.

Get for Chrome Get for Edge Get for Firefox

It audits one page at a time and does not track AI answers. About the extension

Across the whole site

One check here. Every page in SEORCE.

This tool does one job. SEORCE Technical Suite crawls your whole site with fast and secure crawlers and ranks technical issues by impact. AutoFix applies fixes for meta tags, schema, canonical tags, image alt text, headings and internal links for orphan pages on your live site, through one script tag, and the list keeps growing.
Start free Book a demo
3,000+ users · Free forever plan, no card needed
Free tool by SEORCE.