What does Lemwatch monitor?

Lemwatch runs 20+ automated checks per site: uptime, response time, SSL/TLS expiry, domain expiry, DNS changes, sitemap health, broken links, content changes, SEO audits, mobile usability, security headers, and more.

Yes. The free tier monitors up to 5 sites. Pro is $19/month for 50 sites and Agency is $59/month for 100 sites, both with full feature access.

How is Lemwatch different from UptimeRobot or Pingdom?

Lemwatch bundles uptime, change detection, SEO audits, security scans, and a public API in one platform — features competitors charge separately for. It also includes team workspaces, white-labelled status pages, and a webhook system out of the box.

Does Lemwatch send alerts?

Yes. Lemwatch supports email, browser push, webhooks, and per-site notification routing so the right person hears about the right incident.

Is there a public API?

Yes. Pro and Agency plans get a public REST API with webhooks for sites, checks, incidents, and reports.

Why does my padlock disappear on only some pages?

Mixed content is per page, not per site. One old blog post with an http:// image is enough to break the padlock on that post while every other page stays clean. That is why crawling matters more than checking the homepage.

What is the difference between blocked and shown-but-insecure?

Browsers block active content — scripts, stylesheets, iframes — because it could rewrite the page. Passive content like images usually still loads but downgrades the security indicator. Fix the active ones first; they are breaking the page.

Can I just use upgrade-insecure-requests?

It is a good temporary measure: the browser rewrites http:// subresource requests to https:// before sending them. But it only helps browsers that honour it, it fails where the remote host has no HTTPS, and it leaves the wrong URLs in your content, your feeds and your emails.

The tool found nothing but my browser still warns me.

Most likely the insecure request is injected by JavaScript after load — a tag manager, chat widget or ad script. This check reads the server-rendered HTML and does not execute scripts. Open the browser console on the page to find runtime requests.

Does mixed content hurt search rankings?

Not as a direct penalty, but blocked stylesheets and scripts change how the page renders for the crawler, and a page that renders broken is assessed as broken. The trust cost to visitors is the larger problem.

How do I find every affected page, not just one?

Check the templates first — a mixed-content reference in a header, footer or theme asset affects the whole site at once. Then look at older content, which is where pasted http:// links accumulate.

Free Tool

Updated 7 June 2026

mixed content checker

Find HTTP resources loaded on HTTPS pages. Mixed content breaks the padlock icon and creates security warnings.

By Deepak Shukla — Founder & CEO, Pearl Lemon

Part of Security header monitoring — the full answer, the facts and the alternatives in one place.

Enter your URL

What This Tool Checks

Images loaded over HTTP
Scripts loaded over HTTP
Stylesheets loaded over HTTP
Fonts and media over HTTP
iframes loading HTTP content

Why This Matters

Mixed content breaks the HTTPS padlock, triggers browser warnings, and can block resources entirely. Google flags mixed content as a security issue.

How to Fix Issues

1.Update all resource URLs from http:// to https://
2.Use protocol-relative URLs or relative paths
3.Add Content-Security-Policy: upgrade-insecure-requests header
4.Check third-party embeds and scripts

Mixed content is what happens when a page served over HTTPS asks the browser to load something over plain HTTP. The page is encrypted; the image, script or stylesheet inside it is not. Enter a URL above and the check fetches the page and lists every insecure resource reference it finds, grouped by what the browser will do about each one.

Active and passive mixed content are not the same problem

Browsers block active mixed content outright — scripts, stylesheets, iframes and XHR over HTTP simply do not load. That is a functional break: a missing stylesheet makes the page look destroyed, a missing script breaks the checkout. Passive mixed content — images, audio, video — usually still loads but strips the padlock and shows a "not fully secure" state. One is an outage, the other is a trust problem, and a single list that does not distinguish them is not much use. The result here separates them.

Where mixed content comes from

Hardcoded http:// URLs in old content, typically pasted years ago into a CMS. Third-party embeds and widgets that never updated. Image URLs stored absolutely in a database after a migration. A plugin or theme that builds asset URLs from a stale site-URL setting. Ad and tracking tags from smaller vendors. Almost none of it comes from the code someone is currently writing, which is why it survives so long — nobody who works on the site today put it there.

Fixing it properly

Protocol-relative URLs (//example.com/image.jpg) work but are a relic; use explicit https://. Where the remote host supports HTTPS, rewrite the URL. Where it does not, either drop the resource or proxy it through your own domain. A Content-Security-Policy upgrade-insecure-requests directive can rewrite requests on the fly, which is a good bridge while you clean up the source, but it is a patch and not a fix: it hides the problem from browsers while leaving the wrong URL in your database and your feeds.

Why this keeps coming back

A site that is clean today can go mixed tomorrow, because content is added by people who paste URLs. That makes this a check worth repeating rather than a job to finish, especially on sites where editors publish daily.

Methodology

We fetch the URL you enter over HTTPS, following redirects, with a ten-second timeout and a body cap, then scan the returned HTML for every attribute that causes the browser to make a subresource request: src, href, srcset, data, poster, action and the url() references inside inline style blocks. Each reference is resolved against the page's base URL and any result with an http: scheme is recorded. We classify each finding as active (script, link stylesheet, iframe, object, embed, form action) or passive (img, audio, video, poster, background image), because browsers treat those two classes very differently — one is blocked, the other only degrades the padlock. We do not execute JavaScript, so resources injected at runtime by a tag manager or a third-party script will not appear here; those must be found in the browser's own console, and a clean result on a heavily script-driven page should be read with that in mind. Protocol-relative references are reported separately, since their safety depends entirely on the scheme of the parent page.

Frequently Asked Questions

This tool also answers

Why does my padlock icon disappear on HTTPS?

Because at least one asset on the page still loads over http://. Browsers downgrade or block the request and drop the padlock, even though your certificate is perfectly valid. This scan lists every offending resource so you can switch it to https.

Monitor this continuously with LemWatch

A one-off free mixed content checker shows you today. LemWatch re-runs the same checks around the clock and alerts you the moment something breaks — free for up to 10 sites, no card needed.