--- title: "Mixed Content Checker — Free HTTPS Scanner" description: "Free mixed content checker. Find insecure HTTP resources on your HTTPS pages that cause browser warnings and security issues." canonical: "https://lemwatch.com/tools/mixed-content-checker" source: "https://lemwatch.com" --- # mixed content checker > Find HTTP resources loaded on HTTPS pages. Mixed content breaks the padlock icon and creates security warnings. Mixed content is what happens when a page served over HTTPS asks the browser to load something over plain HTTP. The page is encrypted; the image, script or stylesheet inside it is not. Enter a URL above and the check fetches the page and lists every insecure resource reference it finds, grouped by what the browser will do about each one. ## Active and passive mixed content are not the same problem Browsers block active mixed content outright — scripts, stylesheets, iframes and XHR over HTTP simply do not load. That is a functional break: a missing stylesheet makes the page look destroyed, a missing script breaks the checkout. Passive mixed content — images, audio, video — usually still loads but strips the padlock and shows a "not fully secure" state. One is an outage, the other is a trust problem, and a single list that does not distinguish them is not much use. The result here separates them. ## Where mixed content comes from Hardcoded http:// URLs in old content, typically pasted years ago into a CMS. Third-party embeds and widgets that never updated. Image URLs stored absolutely in a database after a migration. A plugin or theme that builds asset URLs from a stale site-URL setting. Ad and tracking tags from smaller vendors. Almost none of it comes from the code someone is currently writing, which is why it survives so long — nobody who works on the site today put it there. ## Fixing it properly Protocol-relative URLs (//example.com/image.jpg) work but are a relic; use explicit https://. Where the remote host supports HTTPS, rewrite the URL. Where it does not, either drop the resource or proxy it through your own domain. A Content-Security-Policy upgrade-insecure-requests directive can rewrite requests on the fly, which is a good bridge while you clean up the source, but it is a patch and not a fix: it hides the problem from browsers while leaving the wrong URL in your database and your feeds. ## Why this keeps coming back A site that is clean today can go mixed tomorrow, because content is added by people who paste URLs. That makes this a check worth repeating rather than a job to finish, especially on sites where editors publish daily. ## What this tool checks - Images loaded over HTTP - Scripts loaded over HTTP - Stylesheets loaded over HTTP - Fonts and media over HTTP - iframes loading HTTP content ## Why it matters Mixed content breaks the HTTPS padlock, triggers browser warnings, and can block resources entirely. Google flags mixed content as a security issue. ## How to fix what it finds - Update all resource URLs from http:// to https:// - Use protocol-relative URLs or relative paths - Add Content-Security-Policy: upgrade-insecure-requests header - Check third-party embeds and scripts ## Methodology We fetch the URL you enter over HTTPS, following redirects, with a ten-second timeout and a body cap, then scan the returned HTML for every attribute that causes the browser to make a subresource request: src, href, srcset, data, poster, action and the url() references inside inline style blocks. Each reference is resolved against the page's base URL and any result with an http: scheme is recorded. We classify each finding as active (script, link stylesheet, iframe, object, embed, form action) or passive (img, audio, video, poster, background image), because browsers treat those two classes very differently — one is blocked, the other only degrades the padlock. We do not execute JavaScript, so resources injected at runtime by a tag manager or a third-party script will not appear here; those must be found in the browser's own console, and a clean result on a heavily script-driven page should be read with that in mind. Protocol-relative references are reported separately, since their safety depends entirely on the scheme of the parent page. ## This tool also answers ### Why does my padlock icon disappear on HTTPS? Because at least one asset on the page still loads over http://. Browsers downgrade or block the request and drop the padlock, even though your certificate is perfectly valid. This scan lists every offending resource so you can switch it to https. ## Frequently asked questions ### Why does my padlock disappear on only some pages? Mixed content is per page, not per site. One old blog post with an http:// image is enough to break the padlock on that post while every other page stays clean. That is why crawling matters more than checking the homepage. ### What is the difference between blocked and shown-but-insecure? Browsers block active content — scripts, stylesheets, iframes — because it could rewrite the page. Passive content like images usually still loads but downgrades the security indicator. Fix the active ones first; they are breaking the page. ### Can I just use upgrade-insecure-requests? It is a good temporary measure: the browser rewrites http:// subresource requests to https:// before sending them. But it only helps browsers that honour it, it fails where the remote host has no HTTPS, and it leaves the wrong URLs in your content, your feeds and your emails. ### The tool found nothing but my browser still warns me. Most likely the insecure request is injected by JavaScript after load — a tag manager, chat widget or ad script. This check reads the server-rendered HTML and does not execute scripts. Open the browser console on the page to find runtime requests. ### Does mixed content hurt search rankings? Not as a direct penalty, but blocked stylesheets and scripts change how the page renders for the crawler, and a page that renders broken is assessed as broken. The trust cost to visitors is the larger problem. ### How do I find every affected page, not just one? Check the templates first — a mixed-content reference in a header, footer or theme asset affects the whole site at once. Then look at older content, which is where pasted http:// links accumulate. ### Why does my padlock icon disappear on HTTPS? Because at least one asset on the page still loads over http://. Browsers downgrade or block the request and drop the padlock, even though your certificate is perfectly valid. This scan lists every offending resource so you can switch it to https. ## Lemwatch at a glance - What it is: website monitoring that checks uptime, page changes, SEO, security, SSL and speed in one tool. - Free plan: 10 sites, no time limit, all check types. - Pro: $19/mo, 50 sites, public API and webhooks. - Agency: $59/mo, 150 sites, white-label status pages. - Source: https://lemwatch.com/pricing (facts verified from the product's own plan limits). ## Related - [All free tools](https://lemwatch.com/tools) - [SSL checker](https://lemwatch.com/tools/ssl-checker) - [security header checker](https://lemwatch.com/tools/security-header-checker) - [SPF DKIM DMARC checker](https://lemwatch.com/tools/spf-dkim-dmarc-checker) - [core web vitals checker](https://lemwatch.com/tools/core-web-vitals-checker) - [Lemwatch pricing](https://lemwatch.com/pricing) - [All monitoring checks](https://lemwatch.com/features) - [Mobile-Friendly Test](https://lemwatch.com/tools/mobile-friendly-checker)