Mixed Content Checker

How it works

Mixed content happens when an HTTPS page pulls http:// scripts, images, styles, or form actions. Browsers block or warn, breaking pixels and sometimes security assumptions. We fetch your public page (size-capped) and lightly parse HTML attributes for http:// asset URLs when the final page is HTTPS.\n\nDynamically injected scripts, CSS url() values, and service-worker fetches may not appear in a static parse. We also will not execute JavaScript. Treat zero findings as “nothing obvious,” not “impossible.”\n\nReplace http:// asset URLs with https:// or protocol-relative/CDN URLs, then re-check. Combine with CSP and TLS checkers for a tighter front-end posture, and use AtRisk when you want ongoing monitoring.\n\nFree teaser only - not a browser lab or penetration test. Common culprits include legacy CDNs hard-coded to http://, WordPress or CMS media URLs, and third-party widgets that still advertise HTTP endpoints. Prefer HTTPS asset URLs everywhere, or load from the same origin. After you fix references, hard-refresh and re-check; caches can hide stale HTML briefly. Pair this with CSP Evaluator so even if a bad URL sneaks back in, the policy limits damage. Then run a full AtRisk scan when the site is feature-complete.

This is a free teaser check - not a penetration test, vulnerability assessment, or compliance audit. AtRisk full scans go deeper across more detectors and unlock fix prompts on Starter.