Website & SEO

Mixed Content Finder

Fetch an HTTPS page and list any sub-resources loaded over insecure HTTP (mixed content) that browsers block or warn about. Free, live.

Find mixed content

Enter an HTTPS URL. We fetch the page and list any resources loaded over insecure HTTP.

What this mixed content finder does

Fetches an HTTPS page server-side
Finds sub-resources loaded over insecure HTTP
Covers scripts, styles, images, iframes and media
Lists every insecure URL to fix
Copies the list for your developers
Explains what the browser will do

Common use cases

  1. 1Fixing a broken padlock icon
  2. 2Auditing a site after an HTTPS migration
  3. 3Finding hard-coded http:// asset URLs
  4. 4Debugging blocked scripts or styles
  5. 5Passing a security review
  6. 6Ensuring a fully secure page

Related tools

Security headers scannerHTTP header inspectorSSL Certificate CheckerFavicon checkerBroken link finderMeta tag auditor

About mixed content

Mixed content happens when a page served over HTTPS loads some resources — a script, stylesheet, image or iframe — over insecure HTTP. Because the insecure resource can be tampered with in transit, browsers block active mixed content (scripts, styles) outright and flag passive mixed content (images), removing the padlock.

This finder fetches the page and scans every sub-resource declared in the HTML for http:// URLs. Fix each by switching it to https:// (or a protocol-relative/absolute HTTPS URL). Note that resources injected later by JavaScript won't appear in a static fetch, so also check the browser console for a complete picture.

More Free Tools Where This Came From

This utility is one of dozens of free, no-login tools for DNS, email, SEO and developers — all instant and private.

See All ToolsTalk to Our Team

HostCloud.in  ·  Pune, India  ·  Serving 34,987+ Websites Since 2020

FREQUENTLY ASKED QUESTIONS

Got Questions? We Have Answers.

What is mixed content?

When an HTTPS page loads a sub-resource — script, style, image, iframe or media — over insecure HTTP. Browsers block active mixed content and flag the rest, removing the padlock.

What does the finder scan?

It fetches the page and lists every sub-resource declared in the HTML with an http:// URL, so you can switch them to https://.

Will it catch everything?

It scans resources declared in the HTML. Resources injected later by JavaScript are not visible to a static fetch, so also check the browser console.

Is it live?

Yes. The page is fetched server-side at the moment you scan.