Scan any HTTPS page for insecure http:// resources (images, scripts, iframes) that break the padlock.
Quick answer
Enter your HTTPS page URL at /tools/mixed-content-checker. It renders the page, catches every http:// request, and shows the exact file and line to fix.
What it checks
Insecure images, scripts, iframes, and stylesheets
Passive vs active mixed content (severity)
Sub-resources loaded by third-party scripts
Broken padlock indicators in modern browsers
URL-level fix suggestions (usually swap to //)
Where to find it in Lemwatch
Public tool: /tools/mixed-content-checker. Use it after a WordPress migration or when moving to HTTPS.
How to use it
Paste the HTTPS URL of the page.
Click Scan.
Review flagged resources grouped by severity.
Update each URL to https:// (or protocol-relative //).
Re-scan to confirm zero mixed content remains.
FAQ
Why does the tool show more resources than my dev tools?
It follows lazy-loaded assets and iframe-embedded scripts that Chrome hides by default.
Will fixing mixed content improve SEO?
Yes — Chrome downgrades mixed HTTPS pages, and Search Console reports them as security issues.