InspectWP Logo

Mixed Content Checker for Your Website

Please provide a valid URL (https://www.example.com).
HTTP Basic Auth For password-protected websites (.htaccess)
Premium Plan Feature
Upgrade

Insecure HTTP resources on your HTTPS page, found automatically

Mixed content test, 100% online and free
Thousands of website owners rely on InspectWP for their HTTPS check

What does the Mixed Content Checker check?

Images, scripts and stylesheets loaded over http://

Fonts, iframes, videos and background requests over HTTP

Resources that browsers would block or silently upgrade

Forms that send their data to an http:// address

Missing redirect from HTTP to HTTPS

HSTS and Content Security Policy headers

How the mixed content check works

From URL to a list of all insecure resources in 4 steps

  1. 1 Step 1

    Enter URL

    Enter the address of the page you want to check. No installation and no registration needed.

  2. 2 Step 2

    Load the page

    We open the page in a real browser, run its JavaScript and log every single request.

  3. 3 Step 3

    Filter insecure requests

    All resources loaded over http://, forms with an insecure target and a missing HTTPS redirect are flagged.

  4. 4 Step 4

    Fix the sources

    Use the list of URLs to correct the addresses in your content, theme or plugins, then run the check again.

These HTTPS problems are detected

Four kinds of insecure content and how browsers deal with them

  • Active mixed content

    Blocked by browsers

    Scripts, stylesheets, iframes and background requests over HTTP. They could change the entire page, so browsers do not load them at all. The visible result is a broken layout or missing functions.

  • Passive mixed content

    Upgraded or blocked

    Images, audio and video over HTTP. Current browsers try to load them over HTTPS automatically. If the file is not available there, it is simply missing from the page.

  • Form with insecure target

    Warning on submit

    A form whose action attribute points to an http:// address sends entries such as names, email addresses or passwords unencrypted.

  • Page without HTTPS redirect

    Not secure

    The page can be opened over http:// and is not redirected to HTTPS. Visitors who follow an old link then use the entire page unencrypted.

The most common causes and how to fix them

Six starting points, from the WordPress settings to the server header

WordPress Address and Site Address
If one of the two addresses under Settings › General still starts with http://, WordPress generates insecure links itself. Set both to https://.
Old links in the database
Images and links in posts are stored as absolute URLs. After the switch to HTTPS they have to be replaced with a search and replace tool that also handles serialized data.
Theme, page builder and plugins
Hardcoded http:// addresses in theme files, slider settings or builder caches survive a database replacement. Correct them at the source and regenerate the builder CSS.
External resources
Fonts, scripts or embedded content from third parties that were integrated years ago with http://. Almost all providers support HTTPS today, so changing the address is enough.
upgrade-insecure-requests
The CSP directive upgrade-insecure-requests tells browsers to request all resources over HTTPS. It is useful as a safety net, but it does not replace cleaning up the actual addresses.
HSTS
The Strict-Transport-Security header makes browsers use HTTPS for your domain from the first request on. Activate it only when the whole site works reliably over HTTPS.
Mixed Content Checker: find insecure HTTP resources

Find mixed content before the browser shows a warning

Mixed content occurs when a page is delivered over HTTPS but loads individual resources over unencrypted HTTP. The result: the padlock disappears, images or scripts are missing, and in the worst case the browser shows "Not secure". The InspectWP Mixed Content Checker loads your page in a real browser and records every single request. All URLs that start with http:// are listed in the report, so you can see exactly which image, script or stylesheet causes the problem.

We also see what your browser hides from you

Modern browsers do not simply show mixed content. They block insecure scripts and stylesheets and try to load insecure images over HTTPS on their own. If you open your page yourself, everything can look fine while the cause is still in your HTML. Our crawler deliberately switches off this automatic upgrade and allows insecure content. That way the report contains the resources that a normal browser would block or silently fix, including those that only appear after JavaScript has run. On top of that we check whether your forms send data to an HTTP address and whether the page redirects to HTTPS at all.

Mixed content test: resources that browsers block or upgrade

Thousands of website owners trust InspectWP

The numbers speak for themselves

0+
Websites analyzed
0+
Plugins detected
0+
Themes detected

Frequently asked questions about the Mixed Content Checker

What mixed content is, why it happens and how to get rid of it

Mixed content means that a page delivered over HTTPS loads parts of its content over unencrypted HTTP. That can be an image, a script, a stylesheet, a font or an iframe. The connection is then only partly encrypted, and browsers react with blocked content or a security warning.

More tools you might need

These checks cover related topics

Your registration could not be saved. Please try again.
Your registration was successful.

Newsletter

Subscribe to our newsletter to stay up to date.

We use Sendinblue as our marketing platform. By completing and submitting the form, you acknowledge that the information you have provided will be sent to Sendinblue for processing in accordance with Terms of Use.