Mixed Content Checker

A mixed content checker finds the resources an HTTPS page still loads over plain HTTP. Enter a page address and this tool reads its HTML, inline styles and up to five of the site's own stylesheets, and lists every http:// script, stylesheet, iframe, image, video, font background and form action. Each one is labelled the way browsers treat it: blocked, upgraded to HTTPS or dropped, or flagged as an insecure form. The tool then tests whether each insecure file is already available over HTTPS, so in most cases the fix is simply changing http:// to https:// in the right place. Mixed content is the most common reason a site that has an SSL certificate still shows a warning instead of a clean padlock.

How to use the Mixed content checker

1. 1 Enter the page addressPaste the full URL of the page with the problem. If you type http://, the checker tests the https:// version, which is what visitors should see.
2. 2 Run the checkWe load the page over HTTPS, scan the markup and inline styles, fetch up to five of the site's own stylesheets, and collect every http:// reference.
3. 3 Review the tableEach insecure URL shows where it was found, how browsers handle it and whether the same file works over https.
4. 4 Fix blocked items firstScripts, stylesheets and frames are blocked and break the page. Change them to https:// or replace them.
5. 5 Clean up the rest and re-testUpdate images, media and form actions, then run the check again to confirm the page is clean.

What mixed content is

A page is served over HTTPS when its address starts with https:// and the connection is encrypted. Mixed content happens when that secure page then pulls in other files, such as scripts, styles, images or embedded frames, over plain HTTP. Those files travel unencrypted, so anyone on the network path could read or alter them, and an altered script can change everything on the page.

Browsers therefore treat mixed content as a security problem. They no longer show a full padlock on a page with insecure resources, and they block or rewrite many of those resources outright. Visitors may see broken layouts, missing images, features that silently stop working, or a "not secure" warning, even though the site has a valid certificate.

Mixed content is almost always left over from moving a site from HTTP to HTTPS. Old absolute URLs remain in theme templates, in posts and pages stored in the database, in plugin settings, in hard-coded embed codes and in stylesheets that reference background images.

Blocked versus upgraded: how browsers handle it

Browsers sort mixed content into two groups. Active content, sometimes called blockable content, can change the whole page: scripts, stylesheets, iframes, objects and embeds, and requests made by JavaScript. Modern browsers block it completely on HTTPS pages, so a stylesheet loaded over http:// simply does not apply and an http:// script never runs.

Passive content, also called upgradable content, cannot change the rest of the page: images, audio and video. Current versions of Chrome, Edge, Firefox and Safari automatically try to load these over HTTPS instead. If the file exists at the https:// address, it loads and the visitor never notices. If it does not, the image or video is dropped and a broken placeholder appears.

Forms are a third case. A form on a secure page whose action points to an http:// address would send whatever the visitor types, including names, emails and passwords, without encryption. Browsers show a warning before such forms submit, which stops many visitors in their tracks.

• Blocked: scripts, stylesheets, preloads, iframes, objects, embeds.
• Upgraded or dropped: images, srcset images, video, audio, posters, icons, CSS background images.
• Warned: forms that submit to http:// addresses.

How to fix mixed content

Start with the files this checker marks as available over HTTPS. For those, the fix is only to change http:// to https:// wherever the URL is written. Better still, for files on your own domain use a relative path such as /images/logo.png, or a URL that already starts with https://, so the problem cannot come back.

Find where each URL lives. Theme or template files hold header scripts, stylesheets and logos. Page and post content in the database holds images and embeds added in the editor. Plugin or app settings hold third-party widgets. Stylesheets hold background images and fonts. Change the URL at its source rather than patching it in the browser.

For third-party files that are not available over HTTPS at all, look for an updated embed code from the provider, host a copy of the file on your own site if its licence allows, or remove it. A service that still cannot serve its files over HTTPS is usually one worth replacing.

Finally, set a safety net. Adding the header Content-Security-Policy: upgrade-insecure-requests tells browsers to request every http:// resource on your pages over HTTPS. It does not fix files that only exist over HTTP, and it is no substitute for correcting the URLs, but it stops new mistakes from breaking pages while you clean up.

Fixing mixed content on WordPress

On WordPress, most mixed content comes from the site address settings and from old URLs stored in post content. First make sure both the WordPress Address and Site Address in Settings, General start with https://. Then replace your old http:// domain with the https:// version throughout the database.

Use a search-and-replace tool that understands serialized data, such as the WP-CLI command wp search-replace or a reputable plugin, rather than editing the database by hand, because some settings are stored in a format that breaks if the length of a string changes. Always take a full backup first and run a dry run to see how many replacements will be made.

Check your theme and child theme files for hard-coded http:// links, and clear any caching plugin and CDN cache afterwards so visitors receive the corrected pages. Plugins that rewrite URLs on the fly can hide the problem, but fixing the stored URLs is faster and more reliable.

Mixed content, SEO and trust

Google uses HTTPS as a lightweight ranking signal and Chrome labels insecure pages clearly. A page whose images fail to load or whose layout breaks because a stylesheet is blocked gives visitors a poor experience, which hurts conversions far more than any ranking signal. Forms that trigger browser warnings lose enquiries directly.

Internal links that still point to http:// pages are not mixed content in the security sense, because the browser simply follows a redirect to the HTTPS page. They do add a redirect to every click and every crawl, so this checker lists them separately. Updating them to https:// keeps your internal linking clean and lets search engines reach the canonical page in one step.

What this checker can and cannot see

The checker reads the HTML that the server sends, inline style attributes and style blocks, and up to five stylesheets hosted on the same domain. That covers the vast majority of mixed content. It does not run JavaScript, so resources that scripts request after the page loads, and files referenced from third-party stylesheets, are not included. If your browser console reports mixed content that does not appear here, it is most likely coming from a script.

Each insecure file is tested over HTTPS with a lightweight request, up to 20 per run, to tell you whether changing the scheme will work. A file that answers with an error over HTTPS needs to be hosted elsewhere or removed. Pair this tool with the SSL Checker to confirm the certificate itself is valid and with the Redirect Checker to make sure HTTP addresses redirect to HTTPS in a single hop.

Examples you can copy

<!-- Blocked on HTTPS pages -->
<script src="http://cdn.example.net/widget.js"></script>

<!-- Fixed -->
<script src="https://cdn.example.net/widget.js"></script>

<IfModule mod_headers.c>
  Header always set Content-Security-Policy "upgrade-insecure-requests"
</IfModule>

wp search-replace 'http://example.com' 'https://example.com' --all-tables --dry-run
# check the counts, take a backup, then run again without --dry-run

Common mistakes to avoid

Frequently asked questions