What counts as mixed content?

Any HTTP resource loaded by an HTTPS page. Browsers categorise scripts/iframes as "active" (always blocked) and images/video as "passive" (warned about).

Does this catch JS-injected mixed content?

No — only static HTML. For runtime scans, use the single-URL tool which renders the page.

My page is HTTPS but the scanner says some resource is HTTP — what now?

Open the row in the single-URL tool to see every offending resource, then update the source (CMS content, template, third-party embed) to https://.

Does upgrade-insecure-requests fix this?

It auto-upgrades resources to HTTPS at request time — a great safety net, but not a substitute for fixing the source URLs.

Can I scan internal URLs?

No. The scan runs from our servers on the public internet, so intranet hostnames, localhost addresses and private IP ranges cannot be reached. Use a publicly resolvable staging URL if you need to test before launch.

Why does my CDN report zero mixed content but this finds some?

CDN logs only see requests that reached the CDN. Mixed content that browsers block never reaches your CDN.

Free Tool

Updated 6 June 2026

Bulk Mixed Content Checker

Find HTTP resources loaded on HTTPS pages across up to 25 URLs. One paste to catch insecure images, scripts, and iframes at scale.

By Deepak Shukla — Founder & CEO, Pearl Lemon

Paste your URLs — one per line, up to 25

0 URLs ready

What This Tool Checks

HTTP <img>, <script>, <link>, <iframe> on HTTPS pages
Per-URL count of insecure resources
First few example offending URLs
Pass / fail verdict per URL

Why This Matters

A single HTTP resource on an HTTPS page can break the padlock, trigger browser warnings, or be blocked outright. At scale, one CMS template change can poison dozens of pages.

How to Fix Issues

1.Sort by "mixed_count" descending — fix the worst offenders first
2.Most common cause: hard-coded HTTP image URLs in CMS content — find/replace at the database level
3.Update <script> and <iframe> embeds to HTTPS (or remove them)
4.Add a Content-Security-Policy upgrade-insecure-requests directive to auto-upgrade legacy URLs

Mixed-content bugs are easy to introduce and easy to miss. A blog editor pastes an HTTP image URL. A legacy embed slips into a template. A third-party script provider quietly serves HTTP fallbacks. Bulk mixed-content scans catch all of it in one paste.

What this tool does

We load each URL, parse the HTML, and list every <img>, <script>, <link>, <iframe>, <video>, and <audio> with an http:// src. The result is a per-URL count and the first few offending resources for context. Export the full list to CSV.

Why it matters

Modern browsers block active mixed content (scripts, iframes) outright and warn on passive mixed content (images, video). The padlock disappears. Some browsers refuse to load the page at all. SEO-wise, Google flags mixed content in Search Console — it is a known crawl-quality issue.

Methodology

For each URL we GET the page (following up to 5 redirects), parse the resulting HTML with a streaming parser, and walk every element with a src or href attribute. We resolve each URL against the page's base URL, then flag anything where the page is HTTPS and the resource is HTTP. Inline data: URIs and protocol-relative // URIs are not flagged. We do NOT execute JavaScript — dynamically injected mixed content (e.g. via document.write) is invisible to this scan. For a runtime scan, use the single-URL Mixed Content Checker.

Frequently Asked Questions

Monitor this continuously with LemWatch

A one-off bulk mixed content checker shows you today. LemWatch re-runs the same checks around the clock and alerts you the moment something breaks — free for up to 10 sites, no card needed.