Website Mixed Content Checker
Fix the “not fully secure” warning. The checker lists every resource an https page loads over plain http – scripts, stylesheets, frames and objects that browsers block, and images, video, audio, srcset candidates and CSS backgrounds that cause warnings or are upgraded – and tests whether each file is also available over https, so you know which addresses you can simply change. Forms that submit to http are flagged too.
- Encrypted connection
- No sign-up
- Free to use
How to use Website Mixed Content Checker
- Enter the https address of the page.
- Click “Find mixed content”.
- Change the fixable addresses to https.
- Run the check again.
Website Mixed Content Checker features
Active and passive
Blocked vs warning.
https test
Is a secure version available?
All sources
srcset, CSS url(), media.
Forms
Insecure form actions.
Safe fetching
Public addresses only, with size and time limits.
Clear fixes
Per resource.
When to use Website Mixed Content Checker
- After moving a site to HTTPS.
- Fixing padlock warnings.
- Old blog posts with hard-coded images.
- Theme or plugin audits.
Website Mixed Content Checker FAQ
What is mixed content?
An https page that loads parts over http. Those parts can be read or changed by others on the network.
Why do some resources break the page?
Browsers block active mixed content – scripts, styles, frames – because it could take over the page.
Can a header fix it?
Content-Security-Policy: upgrade-insecure-requests makes browsers request https versions automatically, if they exist.
Does it check external CSS files?
No, only the HTML and its inline styles.
Will upgrade-insecure-requests fix everything?
It upgrades requests to https automatically, but only works if each resource is actually available over https. Resources that are not will fail to load.
Why do I see “not fully secure” even with a valid certificate?
Because the page loads at least one resource over http. The certificate is fine; the content needs to be switched to https.
Can a CMS plugin fix mixed content?
Some plugins rewrite http addresses on the fly, but fixing the addresses in the database and templates is cleaner and faster.
Fixing the “not fully secure” warning
Mixed content usually comes from hard-coded http:// addresses in old content, themes or settings. A search-and-replace in the database or templates fixes most of it.
Prefer https:// or relative addresses for every resource.
Mixed content means an https page loads some resources over plain http. Browsers block active mixed content – scripts, stylesheets, iframes and objects – which can break the page, and upgrade or warn about passive content such as images, video and audio, which removes the padlock.
The checker lists every http resource, including srcset candidates and CSS backgrounds, and tests whether the same file is available over https. If it is, the fix is simply changing the address to https:// in your template, content or database.
In a CMS, http addresses often sit in old posts or settings after moving to HTTPS. A search-and-replace in the database and the Content-Security-Policy directive upgrade-insecure-requests can fix most cases quickly.
Mixed content often returns after switching to HTTPS through old blog posts, hard-coded image links, embedded widgets and third-party scripts. Run the check on a sample of older pages as well as new ones, and fix the source of the http addresses – a database search-and-replace or template change – rather than each page by hand.
Adding upgrade-insecure-requests to your Content-Security-Policy is a useful safety net while you fix the remaining addresses at their source.