Mixed Content Checker

Mixed content occurs when an HTTPS page loads resources (images, scripts, stylesheets, iframes) over HTTP instead of HTTPS. Since the page itself is served securely, the HTTP resources can be intercepted and modified by a man-in-the-middle attacker, undermining the page's security. Modern browsers block 'active mixed content' (scripts, stylesheets, iframes) by default and may warn about or automatically upgrade 'passive mixed content' (images, audio, video).

Active mixed content includes resources that can modify the page's DOM or execute code — scripts, stylesheets, iframes, XHR/fetch requests, and flash objects. Browsers block active mixed content entirely because it poses a high security risk. Passive mixed content includes resources that cannot modify the page — images, audio, and video. Browsers historically displayed a warning for passive mixed content but still loaded it; modern browsers increasingly upgrade these requests to HTTPS automatically.

Fix mixed content by updating all resource URLs from http:// to https://. In your HTML, CSS, and JavaScript, replace hardcoded http:// URLs with https:// or protocol-relative URLs (//example.com/resource). For CMS platforms like WordPress, plugins such as 'Really Simple SSL' can automate this. Add the Content-Security-Policy header upgrade-insecure-requests directive to automatically upgrade HTTP requests to HTTPS at the browser level. Check your database for stored HTTP URLs in content fields.

Mixed content can indirectly affect SEO. Google treats HTTPS as a ranking signal, and a site with mixed content warnings is not fully secured. Browser warnings about mixed content reduce user trust and may increase bounce rates, which can signal poor page quality. Additionally, if mixed content causes browsers to block critical resources (scripts or stylesheets), it can break page functionality and layout, severely impacting both user experience and crawlability.