Mixed Content Detector
Inspect an HTTPS page for resources still requested over insecure HTTP so you can identify mixed content, trace the affected asset, and decide where the reference needs to be corrected.
What this tool checks
Scripts, Styles, and Images
Checks page resources such as scripts, stylesheets, and images for insecure HTTP requests. Review each finding to determine whether the reference is controlled by the page, a template, a plugin, or an external provider before changing it.
Media, Frames, and Fonts
Scans media files, embedded frames, and font requests for insecure loading on an HTTPS page. These resources may be handled differently by browsers, so use the finding to locate the source reference and confirm that a secure version of the asset is actually available.
Inline CSS Resource References
Looks for HTTP resource references inside inline style attributes and other page-level CSS declarations. This helps surface mixed content that can be missed when you inspect only linked files or visible image elements.
Why Mixed Content Should Be Fixed
Mixed content occurs when a secure page requests part of its content through an insecure connection. Browsers can warn about, upgrade, or block affected resources depending on the resource type and browser behavior, which can leave a page with broken functionality or inconsistent presentation. Treat the detector as a way to locate insecure requests, then verify the secure replacement before updating the reference.
Common issues this tool detects
A template, stylesheet, content block, or script can still contain http:// instead of https:// or protocol-relative URLs. Update only after confirming that the destination supports a secure request and that the change will not alter the intended asset.
External scripts, widgets, fonts, or media can introduce mixed content even when your own templates are secure. Identify the provider that owns the asset and switch to a secure endpoint only when that endpoint is supported.
Older CDN paths and copied asset references may still use HTTP after the main site has moved to HTTPS. Trace the reference back to the template, database content, stylesheet, or integration that generates it so the underlying source is fixed rather than patched only in rendered output.
Frequently asked questions
What does mixed content mean on an HTTPS page?
Mixed content means an HTTPS page requests at least one resource, such as an image or script, over insecure HTTP. The page itself may still load, but the browser can treat the insecure resource differently based on its type and current browser rules.
How should I fix mixed content findings?
Update affected resource URLs to HTTPS after confirming that the secure destination works. If your existing implementation intentionally uses protocol-relative URLs (//), review whether keeping that pattern is appropriate for your stack rather than changing references blindly. The goal is for resources on the secure page to load securely without breaking the asset or integration.