Mixed Content Checker

Find HTTP resources referenced by an HTTPS page — the kind that trigger browser security warnings.

What is a mixed content checker?

A mixed content checker finds insecure http:// resources referenced by a page that is itself served over HTTPS. Mixed content weakens the protection HTTPS gives: an attacker could change an insecure script or stylesheet on its way to the visitor. Browsers block many of these resources outright and show a warning or a broken padlock for others, which can leave pages with missing images, styling or features.

This tool reads the page's HTML and lists every insecure reference it finds, with its type.

How the mixed content check works

The tool downloads the page you enter, following redirects, and checks that the final page is on HTTPS. It then searches the HTML for http:// addresses in src, href and action attributes and in CSS url() values, removes duplicates and labels each one:

Script, Stylesheet/resource, Image and Iframe
Media for audio and video sources
Form for form actions
CSS resource for addresses inside styles
Other for anything else, including ordinary links

Because only the HTML is read, the check is quick and makes a single request to the site. The referenced files are not downloaded themselves. Up to 20 distinct results are shown, and pages larger than 2 MB cannot be checked.

How to use the mixed content checker

Enter the address of the page that shows a warning, or your home page.
Press Check for Mixed Content.
Read the list of HTTP resources and their types.
Change each address to https:// in your site, theme or content, then check again.

What the mixed content results mean

Active and passive mixed content

Scripts, stylesheets, iframes and form actions can change how the page works, so browsers block them on HTTPS pages. Images and media are less risky; modern browsers try to upgrade them to HTTPS automatically and may block them if that fails.

Items labelled Other

Plain links to http:// pages appear as Other. A link is not mixed content in the browser sense, because nothing loads until someone clicks it, but switching links to HTTPS is still good practice.

No references found

The HTML itself is clean. Resources added later by JavaScript are not seen by this check, so use your browser's developer console if warnings continue.

Finding mixed content in your browser

For a second view, open the page in Chrome, Edge or Firefox, open the developer tools, usually with F12, and choose the Console tab. Each blocked or upgraded resource is listed with its address. This also catches resources added by JavaScript after the page loads, which a check of the HTML cannot see. Fix the place each address comes from, such as a theme setting, a plugin or the post content, rather than hiding the warnings.

Common uses

Fixing a broken padlock after moving a site to HTTPS.
Checking pages after a theme or plugin update.
Finding old hard-coded image links in blog posts.
Checking that embedded videos, maps and widgets load over HTTPS.

Common problems and fixes

Images in old posts use http. Run a search-and-replace on your database or content to change your own domain's addresses to HTTPS. Back up first.

Fonts or scripts from a CDN use http. Almost all public CDNs serve the same files over HTTPS. Change the start of the address to https:// in your theme or template.

A third-party resource has no HTTPS version. Replace the service, or host the file yourself on your HTTPS site.

The page is not HTTPS. Mixed content only applies to HTTPS pages. Set up a certificate first with the SSL Checker.

Related tools

SSL Checker confirms the page's certificate is valid.
Website Security Checker reviews SSL and headers together.
Security Headers Checker explains Content-Security-Policy.
Redirect Checker confirms pages redirect to HTTPS.

Frequently asked questions

What is mixed content?

Mixed content is when a page loaded over HTTPS includes resources, such as scripts, styles or images, from plain http:// addresses. Those resources travel without encryption and could be changed by an attacker, so browsers block or flag them, which can break the page or remove the padlock.

Why is my padlock missing even though I have SSL?

The certificate may be fine while the page still loads some resources over plain HTTP. Browsers then show a warning or remove the secure padlock. Run the mixed content checker on that page to list the insecure addresses, then change each one to https://.

How do I fix mixed content in WordPress?

Make sure the WordPress Address and Site Address settings use https://. Then update old content, which often has http:// image links saved in posts, using a search-and-replace plugin or tool. Back up the database first and check theme files for hard-coded addresses.

Does this tool find mixed content loaded by JavaScript?

No. It checks the page's HTML as the server sends it. Resources added later by scripts in the browser are not visible to it. If warnings remain after fixing everything listed, open your browser's developer console, which names every blocked resource on the page.

Why are normal links listed as Other?

The checker lists every http:// address in src, href and action attributes, which includes ordinary links. A plain link is not mixed content in the browser sense, because nothing loads until it is clicked. Updating those links to HTTPS is still good practice where the other site supports it.

Can Content-Security-Policy help with mixed content?

Yes. The upgrade-insecure-requests directive tells browsers to request every http:// resource on the page over HTTPS instead. It is a useful safety net, but it only works if each resource is actually available over HTTPS, so fixing the addresses at the source is still the best solution.

Why does the checker show only 20 results?

To keep the report readable, the first 20 distinct insecure addresses are shown, and the page says when there may be more. Fix those, then run the check again to see the next set. Many results usually come from one source, such as a theme setting or old content.