Mixed Content Checker
Find insecure resources on an HTTPS page
An HTTPS page that pulls a script or stylesheet over HTTP has that resource blocked outright by every modern browser — which usually means something on the page is quietly broken. Images and media are treated more leniently but still cost you the padlock. This lists each one and says which kind it is.
Frequently asked questions
What is the difference between active and passive mixed content?
Active content — scripts, stylesheets, frames — can change the whole page, so browsers refuse to load it over HTTP. Passive content like images can only affect what is displayed, so it is usually upgraded or allowed with a warning.
Can I just add upgrade-insecure-requests?
It works as a safety net: browsers rewrite http:// to https:// before requesting. But it hides the problem rather than fixing it, and it only helps if the resource is actually available over HTTPS.
I fixed my HTML and it still shows insecure requests. Why?
This tool reads the HTML only. Resources injected by JavaScript, or loaded by a third-party script you embed, will not appear here — check the browser console for those.