Mixed Content Checker: HTTP on HTTPS Pages
List HTTP scripts, stylesheets, images, and media on an HTTPS page. Active vs passive, plus an HTTPS HEAD check. Free, no login.
- Paste an HTTPS page URL
- Run the mixed content check
- Read active rows and the HTTPS column
- Browser-based — no install
- Instant results
Paste an HTTPS page URL to list http:// subresources in the server HTML: scripts, stylesheets, iframes, images, media, CSS url() values, and form actions. Active rows are blocked by browsers. Passive rows warn. Anchor links are listed apart and are not mixed content. No JavaScript.
By Faisal YUpdated
An HTTPS page that still requests something over HTTP is serving mixed content . The document is encrypted. The subresource is not. Browsers treat that split differently depending on what the subresource is. Scripts, stylesheets, iframes, and fonts get blocked. Images, audio, and video usually still load, with a warning. A plain link to an HTTP URL is a navigation, not mixed content. This guide covers those categories, where the URLs hide in HTML and CSS, and how to fix them. The Mixed Content Checker lists what is in the server HTML. It does not replace the browser console for anything a script inserts later. What mixed content is Mixed content happens only when the page is HTTPS and a subresource is HTTP. If the page itself is HTTP, there is nothing to mix: the whole document is already insecure. The usual cause is a move to HTTPS that left embedded URLs alone. A template, a CMS field, or a third-party snippet still contains http:// . MDN's mixed content guide splits subresources into two groups. Active mixed content can change the page: scripts, stylesheets, iframes, objects, fetches, and fonts. Passive mixed content is what the page displays: images, audio, and video. Chrome's mixed content article uses the same split. Active requests are blocked. Passive requests are allowed with a warning, and current browsers may upgrade some of them to HTTPS on their own. Do not treat that upgrade as the fix. A host that does not serve the file over HTTPS still fails, and you will have a harder time seeing the original URL. The URL that matters is the one the browser requests, not the one you remember typing into a preview. A root-relative path such as /js/app.js inherits the page scheme, so it stays HTTPS on an HTTPS…
Read the full guideWhat you paste
Paste one HTTPS page URL. A hostname without a scheme is requested as https. The checker fetches that document from Scrawl's servers with a 10 second timeout and a 2 MB cap, then reads the HTML. It does not log into the site. Private, loopback, and metadata hosts are blocked before any request.
How to read active, passive, and link rows
Active rows are requests browsers block on an HTTPS page: script src, iframe src, a stylesheet href, object data, embed src, a form action, preload as script or style, an @import of an http stylesheet, and @font-face files. Fix these first. A blocked script or stylesheet changes how the page runs.
Passive rows are images and media: img src and srcset, video, audio, source, poster, icon links, preload as image, and CSS url() values that are not fonts. Browsers warn. The rest of the page can still load while an image stays broken or the lock icon is degraded.
Link rows are http addresses in an a href. They are not mixed content. Following one leaves the page. They are listed so leftover http links are visible without being treated as blocked subresources.
Each row shows the element, the attribute, the URL, and where it was found: the HTML, a style element, a style attribute, or a same-origin stylesheet that was fetched.
The HTTPS column
For each http URL the checker sends a HEAD request to the same path with https, up to 20 unique addresses. Subresources are checked before plain links. Yes and a status under 400 means that HTTPS URL responded. No means a 4xx, a 5xx, or no response. Not checked means the cap was reached. Yes on a script or image is a candidate to rewrite in the template. No means that host is not serving the file over HTTPS, so a scheme swap will not fix it.
Same-origin stylesheets linked from the page are fetched, up to 5, and http url() and @import values inside them are added. A stylesheet on another host is not fetched. If its href is already http, that link is an active row and the files it would load are not expanded.
What this scan does not see
JavaScript that inserts a script, image, or iframe after load is invisible here. data-src and other lazy-load attributes are not read. Use the browser console on the live page to confirm what actually requested http after scripts ran. This report is the server HTML plus a capped set of same-origin stylesheets.
For the certificate itself, use the SSL Certificate Checker. For response headers such as Content-Security-Policy and Strict-Transport-Security, use the Security Headers Checker.
Frequently Asked Questions
Which rows should I fix first?
Active rows. Those are scripts, iframes, stylesheets, objects, embeds, form actions, and font files served over http. Browsers block them on an HTTPS page, so the page can lose behavior or layout. Passive image and media rows warn. http links in anchors are not mixed content.
What does Yes in the HTTPS column mean?
The checker requested the same URL with https using HEAD. Yes means the status was under 400. It does not prove the file bytes match the http copy. No means a 4xx, a 5xx, or no response, so changing only the scheme will not load that file.
Why is an http link in its own group?
An a href that starts with http is a navigation, not a subresource of the HTTPS page. Browsers do not block it as mixed content. The table still lists it so you can update leftover links without mixing them up with blocked scripts.
Why does the browser flag mixed content that this table misses?
This check reads the HTML the server returned and up to five same-origin stylesheets. It does not run JavaScript and it does not read data-src. A tag manager, a lazy-loader, or a widget can request http only after the page runs. Confirm those in the browser network panel.
What are the limits?
One URL per run, a 10 second timeout, a 2 MB body cap, five same-origin stylesheet fetches, and 20 HTTPS HEAD checks. Private and localhost targets are blocked. Cross-origin stylesheets are not downloaded.
Related tools
SSL Certificate Checker
Technical SEOCheck any domain's SSL certificate instantly. See issuer, expiry date, days rema…
Security Headers Checker
Technical SEOAudit HTTP security headers, get a letter grade, and copy ready-made Apache, Ngi…
HTTP Header Checker
Utility ToolsInspect raw server response headers to verify caching policies, security headers…
Canonical Checker — Find Missing & Wrong Tags
On-Page SEOVerify rel=canonical tags to resolve duplicate content issues and consolidate ra…