All tools
/mixed-content-checker
Mixed Content Checker
Find HTTP resources loaded on an HTTPS page.
Try:
About Mixed Content Checker
Mixed Content Checker fetches a page over HTTPS and scans it for resources, scripts, stylesheets, images and similar, that are loaded over plain HTTP instead, which browsers block or flag as insecure.
Use this after migrating a site to HTTPS to catch old hardcoded http:// references left behind in templates or content, since a page can look fine while a browser is silently blocking part of it in the background.
This only checks the page you give it, not every page on the site, and it looks for common resource-loading patterns in the HTML rather than executing JavaScript, so content injected dynamically after the page loads is not covered.
Tutorials
HTTPS and TLS, What the Padlock Is Actually Telling YouWhat encryption in transit protects against, what it does not, and why a valid certificate and a security header check both matter.6 min readContent Security Policy ExplainedWhat a CSP header actually restricts, why it matters even on a site with no obvious vulnerabilities, and how to read one without getting lost in the syntax.6 min readWhat Mixed Content Is and Why Browsers Block ItWhy an HTTPS page loading even one resource over plain HTTP undermines the whole connection, and the difference between what browsers block outright and what they merely warn about.5 min read