Security Tools

Mixed Content Detector

Check whether an HTTPS site guards against insecure http:// resources breaking its padlock.

Checks response headers only - does not scan page content for mixed-content resources.

Not sure what to enter? Try an example: github.com

Free & instant No signup How to use FAQ

Enter a URL to check its HTTPS status and whether its Content-Security-Policy upgrades or blocks insecure http:// images, scripts and styles.

What is mixed content?

Mixed content happens when an HTTPS page loads images, scripts or styles over plain HTTP. Browsers block or warn about it, which can break the page and remove the padlock. This detector checks the security headers that protect against it, such as a CSP with upgrade-insecure-requests and HSTS.

How to check for mixed content protection

Enter the domain in the box above.
Click Check Mixed Content.
See whether upgrade-insecure-requests, HSTS and related protections are in place.
Change hard-coded http:// asset URLs in your pages and database to https:// as well.

Related checks

To check the site's certificate, use the SSL Certificate Checker.
For the Content-Security-Policy, use the CSP Checker.

Fix mixed content by changing http:// links to https:// in your theme, database and CDN settings, then test again here. JustChecker monitors your SSL certificate so the padlock stays green once the page is clean.

Frequently Asked Questions

An HTTPS page that loads images, scripts or styles over plain http://. Browsers block insecure scripts outright and may show the page as not fully secure.

Open the page, press F12 and look at the Console - browsers list every mixed-content request. Search your theme and database for http:// links to your own domain.

Added to your Content-Security-Policy, it makes browsers fetch http:// resources over HTTPS automatically - a quick safety net while you fix the links.

Share this tool:

Need a website for your business? Only $599