Free Mixed Content Scanner

Mixed content occurs when an HTTPS page loads resources (images, scripts, styles) over HTTP, which browsers block or warn about.

Active mixed content (scripts, stylesheets) is blocked by browsers. Passive (images, video) shows a warning.

Yes, completely free.

Absolutely. The Mixed Content Scanner processes everything client-side in your browser. No data is uploaded to or stored on any server. Your content remains private on your device at all times.

Yes, the Mixed Content Scanner is fully responsive and works on smartphones and tablets. You can use it on any device with a modern web browser -- no app download required.

No account or registration is needed. Simply open the Mixed Content Scanner in your browser and start using it immediately. There are no sign-up walls or usage restrictions.

Simply enter your input in the provided field, adjust any settings to your preference, and the tool will process it instantly. You can then copy the result to your clipboard or download it.

The Mixed Content Scanner works in all modern browsers including Chrome, Firefox, Safari, Edge, and Opera. For the best experience, use the latest version of your preferred browser.

A valid SSL certificate only secures your page's own connection — it can't fix sub-resources that still load over plain HTTP. If a single image, script, stylesheet, or font on the page points to an "http://" URL, the browser flags the whole page as mixed content and may drop the padlock or show a "Not Secure" label. Active resources like scripts and stylesheets are often blocked outright, which can break charts, sliders, and analytics, while passive ones like images simply downgrade the connection's trust signal. The certificate is doing its job; the leak is in your markup. Paste your page's HTML source into this scanner and it lists every insecure resource by element type, line number, and exact HTTP URL so you can find what's costing you the secure padlock and fix it.

The fastest way is to inspect the actual HTML your page sends. Open the page, right-click, choose View Page Source (or grab your framework's rendered output), then paste the full markup into this scanner and click Scan for Mixed Content. It pattern-matches every resource-loading element — images, scripts, stylesheets, iframes, objects, embeds, video, audio, fonts, form actions, and HTTP URLs inside CSS url() and background declarations — and reports each one with its element type, the line number in your source, and the offending HTTP URL. That line number lets you jump straight to the problem in your editor instead of hunting blindly. Results are split into active (blocked) and passive (warning) so you know what's breaking versus what's just downgrading security. Use the Copy All URLs button to grab every insecure link at once for a find-and-replace pass.

Both fix mixed content, but they work at different levels. A protocol-relative URL drops the scheme entirely — you write "//example.com/file.js" and the browser loads the resource over whatever protocol the page itself uses, so an HTTPS page pulls it over HTTPS automatically. It's a per-link edit and assumes the host actually serves the file securely. The Content-Security-Policy "upgrade-insecure-requests" directive is a site-wide header that tells the browser to silently rewrite every HTTP sub-resource request to HTTPS before fetching it, making it a fast safety net during an HTTPS migration. The cleanest long-term fix is still changing "http://" to "https://" directly where the secure version exists. This scanner shows all three remedies once it detects issues, and the Copy All URLs button makes a bulk find-and-replace straightforward.

It scans only the HTML you paste — it does not fetch or crawl the live URL. The tool parses your markup locally in the browser, matching it against known resource-loading elements and CSS references to find insecure "http://" links. This design keeps everything private: source from an internal staging site, an unreleased page, or a client project never leaves your device, with no upload, storage, or account required. The trade-off is that the scanner sees exactly what's in the markup you provide and nothing more. If resources are injected by JavaScript after load, View Page Source may not include them, so paste the fully rendered DOM (for example from your browser's Elements panel or your framework's server output) for the most complete results. Paste your full rendered source above to catch every insecure reference.

Indirectly, yes. Google treats HTTPS as a ranking signal and surfaces security warnings to users, so a page flagged as "Not Secure" can hurt click-through and trust even if the URL still ranks. The bigger risk is functional: active mixed content like blocked scripts and stylesheets can break layouts, interactive widgets, and analytics, which damages user experience, engagement metrics, and any tracking you rely on to measure SEO performance. Passive issues won't break the page but cost you the padlock that signals a safe site. Cleaning up every insecure resource is simply part of implementing HTTPS correctly. This scanner separates active (blocked) from passive (warning) findings and gives you the exact line and URL for each, so you can resolve the page-breaking issues first and then tidy the rest before you ship.