Bulk Mixed Content Checker

Find HTTP resources loaded on HTTPS pages across up to 25 URLs. One paste to catch insecure images, scripts, and iframes at scale.

Mixed-content bugs are easy to introduce and easy to miss. A blog editor pastes an HTTP image URL. A legacy embed slips into a template. A third-party script provider quietly serves HTTP fallbacks. Bulk mixed-content scans catch all of it in one paste.

## What this tool does

We load each URL, parse the HTML, and list every <img>, <script>, <link>, <iframe>, <video>, and <audio> with an http:// src. The result is a per-URL count and the first few offending resources for context. Export the full list to CSV.

## Why it matters

Modern browsers block active mixed content (scripts, iframes) outright and warn on passive mixed content (images, video). The padlock disappears. Some browsers refuse to load the page at all. SEO-wise, Google flags mixed content in Search Console — it is a known crawl-quality issue.

What this tool checks

• HTTP <img>, <script>, <link>, <iframe> on HTTPS pages
• Per-URL count of insecure resources
• First few example offending URLs
• Pass / fail verdict per URL

Why it matters

A single HTTP resource on an HTTPS page can break the padlock, trigger browser warnings, or be blocked outright. At scale, one CMS template change can poison dozens of pages.

How to fix what it finds

• Sort by "mixed_count" descending — fix the worst offenders first
• Most common cause: hard-coded HTTP image URLs in CMS content — find/replace at the database level
• Update <script> and <iframe> embeds to HTTPS (or remove them)
• Add a Content-Security-Policy upgrade-insecure-requests directive to auto-upgrade legacy URLs

Methodology

For each URL we GET the page (following up to 5 redirects), parse the resulting HTML with a streaming parser, and walk every element with a src or href attribute. We resolve each URL against the page's base URL, then flag anything where the page is HTTPS and the resource is HTTP. Inline data: URIs and protocol-relative // URIs are not flagged. We do NOT execute JavaScript — dynamically injected mixed content (e.g. via document.write) is invisible to this scan. For a runtime scan, use the single-URL Mixed Content Checker.

Frequently asked questions

What counts as mixed content?

Any HTTP resource loaded by an HTTPS page. Browsers categorise scripts/iframes as "active" (always blocked) and images/video as "passive" (warned about).

Does this catch JS-injected mixed content?

No — only static HTML. For runtime scans, use the single-URL tool which renders the page.

My page is HTTPS but the scanner says some resource is HTTP — what now?

Open the row in the single-URL tool to see every offending resource, then update the source (CMS content, template, third-party embed) to https://.

Does upgrade-insecure-requests fix this?

It auto-upgrades resources to HTTPS at request time — a great safety net, but not a substitute for fixing the source URLs.

Can I scan internal URLs?

Only publicly accessible URLs over the internet.

Why does my CDN report zero mixed content but this finds some?

CDN logs only see requests that reached the CDN. Mixed content that browsers block never reaches your CDN.