Mixed content checker online
If your site has HTTPS but the browser says not fully secure, the cause is resources loaded over http. Enter an address and we will find such images, scripts and styles.
What the mixed content checker finds
Mixed content is anything an HTTPS page loads over plain http: images, scripts, styles, frames, video and audio, embedded objects and forms that send data to an http address. Browsers block insecure scripts and frames outright and show a warning instead of the padlock for the rest.
The checker downloads the page and goes through its HTML looking for src, href, data and action attributes that start with http://, then lists every match. It reads the HTML as the server sent it, so resources added later by JavaScript or referenced inside CSS files, such as background images and fonts, are not seen. If the padlock is still broken after a clean result, look there.
How to read the result
- No mixed content found: every resource in the HTML is loaded over https.
- Found resources loaded over http: the list shows each address and the tag that loads it. Change http:// to https:// at the source, or remove the resource if the other server has no HTTPS.
- The page runs without HTTPS: mixed content does not apply until the site itself is on https.
- Most mixed content comes from old absolute links stored in the database before the move to HTTPS, addresses hard-coded in theme files and third-party embeds.
Related errors and guides
- Mixed content: the padlock is broken
- How to fix mixed content after moving to HTTPS
- How to enable HTTPS in WordPress
- How to fix the Not secure warning in Chrome
Frequently asked questions
- Does mixed content affect the full check score?
- Yes. If the page is on HTTPS and at least one http resource is found, the full check takes off 2 points, because visitors see a broken padlock.
- How do I fix mixed content in WordPress?
- Set both site addresses to https in Settings, General, then replace http://your-domain with https://your-domain in the database using a search and replace tool that handles serialized data. Afterwards check the theme and widgets for hard-coded links.
- Can a Content-Security-Policy fix it automatically?
- The upgrade-insecure-requests directive tells browsers to request http resources over https instead. It only helps if those resources are actually available over https.