URL to scan
The URL must be HTTPS, mixed content only matters on a secured site.
Scan your HTTPS page for resources served over HTTP. One HTTP iframe is enough to break the padlock and erode user trust.
The URL must be HTTPS, mixed content only matters on a secured site.
A page served over HTTPS that loads resources (images, scripts, iframes, fonts) over HTTP. The browser shows a crossed-out padlock or a "not secure" warning, immediate loss of user trust. Worse, on modern Chrome, HTTP scripts and iframes are automatically blocked ("active mixed content"), which literally breaks the page.
Active = scripts, iframes, XHR, WebSocket, resources that can modify the DOM. Blocked automatically by browsers since 2020. Passive = images, videos, audio, cannot run code but trigger the "not secure" warning. Chrome automatically upgrades HTTP images to HTTPS since Chrome 90, but that remains a fragile fallback.
Three options. (1) Upgrade server-side, change URLs in your CMS to use https:// or relative URLs (//example.com/ or /path). (2) Content Security Policy, add upgrade-insecure-requests which forces the browser to try HTTPS. (3) If the resource is not available over HTTPS (rare in 2025), host it on your own server or replace it.
We scan static HTML for: img/script/link/iframe/video/audio/embed/object/source/form. We do not follow dynamic JS imports, runtime fetch() calls, WebSockets, or resources injected by an external script. For those, open DevTools → Security tab or Console, Chrome reports all mixed content actually loaded. This tool pre-flags obvious cases before a deploy.
Our network catalog is browsable without signup. Publisher pricing shown, no commission, no middleman.