Sign up free

Mixed Content Checker

Find the http:// images, scripts and styles that break the padlock on an HTTPS page.

More tools
Speed & statusWebsite Speed TestHTTP Status Code CheckerRedirect CheckerIs It Down?GZIP and Brotli CheckerCDN CheckerWebsite Technology DetectorView Page Source

About Mixed Content Checker

After a move to HTTPS, a missing padlock usually means mixed content: files the page still loads over plain http://. This mixed content checker reads your HTTPS page and lists them. Active content, meaning scripts, stylesheets, iframes, objects and form targets, is blocked by browsers and can break the page. Passive content, such as images, video and audio, srcset entries and CSS url() references in the page, costs you the padlock.

For the first 40 addresses found, the checker also tests whether the same file works over https://. Those you can fix by changing http:// to https:// in your templates, database or CDN settings, while the rest need a new source or a copy on your own server. Export the list as CSV for whoever maintains the site. An http:// address you enter is checked as https://. To make sure HTTP itself redirects to HTTPS, use the Redirect Checker.

How to use Mixed Content Checker

  1. 1
    Enter the HTTPS page

    Paste the page address, and an http:// address is checked as https://.

  2. 2
    Click Check

    We read the HTML and collect every http:// resource in it.

  3. 3
    Review the list

    Each entry shows its type, whether browsers block it and whether it works over HTTPS.

  4. 4
    Fix and export

    Switch the links to https://, or download the list as CSV for your developer.

Why use Cubfile for this

  • Active and passive

    Scripts, styles, frames, objects and forms, plus images, media, srcset and CSS url().

  • HTTPS tested for you

    The first 40 insecure addresses are tried over https:// automatically.

  • Blocked or downgraded

    See which files browsers block outright and which only cost you the padlock.

  • CSV export

    Hand the full list to a developer or work through it in a spreadsheet.

FAQ

Mixed Content Checker: questions and answers

What's the difference between active and passive mixed content?
Active content such as scripts, styles and iframes can change the whole page, so browsers block it. Passive content such as images and video is upgraded or blocked by the browser and costs you the padlock.
How do I fix mixed content?
Where the checker says a file works over HTTPS, change http:// to https:// in templates, stored posts and theme or CDN settings. Host a copy of the others yourself or find another source. As a stopgap, a Content-Security-Policy header with upgrade-insecure-requests asks browsers to upgrade the requests. Once it's added, the Security Headers Checker confirms the Content-Security-Policy header is being sent.
Does it check files referenced inside CSS or JavaScript files?
No. It reads the page's HTML, including inline styles, but not the contents of separate CSS or JavaScript files, and it doesn't run scripts. If the padlock is still missing, check those files too. A certificate problem can also hide the padlock, which the SSL Certificate Checker can rule out.
Why does it say the page doesn't stay on HTTPS?
The HTTPS address redirected to an http:// page, so there's no secure page to check. Serve the page over HTTPS first, then check again.
Is the mixed content checker free?
Yes, with no sign-up and no daily tasks used. The result isn't stored.
Share Mixed Content Checker with a friendIt runs in any browser, and they can try it without signing up.

Related tools

WEB Website Speed TestTime DNS, connection, first byte and download for a page, and see what slows it down.
SSL SSL Certificate CheckerCheck a site’s certificate: issuer, expiry, domains covered and whether browsers trust it.
HTTP HTTP Status Code CheckerCheck the status code of one URL or a whole list at once.
HTTP Redirect CheckerFollow every redirect hop, with status codes and timing, and catch loops.
WEB Website Technology DetectorSee the CMS, frameworks, analytics, CDN and server a website uses.
WEB Is It Down?Find out whether a site is down for everyone, and which step fails.
WEB CDN CheckerFind out whether a domain is behind a CDN, and which one.
WEB GZIP and Brotli CheckerCheck whether a page is sent compressed and how much it saves.