Free Mixed Content Checker
Find every image, script, stylesheet, iframe and form loaded over insecure http:// on your HTTPS pages – the reason your padlock disappears – and fix them all with clear step-by-step instructions.
What is a Mixed Content Checker?
Mixed content happens when an HTTPS page loads files – images, scripts, stylesheets, iframes – over insecure http://. A mixed content checker scans the page source and lists every insecure resource, separated into active content (blocked by browsers) and passive content (warnings).
Mixed content is the most common problem after moving a WordPress site to HTTPS. It removes the padlock, shows “Not secure” warnings and can break layouts when scripts or styles are blocked. Old http:// URLs saved in posts and page-builder data are the usual cause.
What the Mixed Content Checker checks
Every problem comes with plain-English steps to fix it, and every result is added to your downloadable Technical SEO report.
Scripts, stylesheets, iframes, objects and form actions over http://.
Images, srcset, video, audio and posters over http://.
url(http://…) in inline styles and style blocks.
Optionally scan up to 10 pages of your site.
Links that cause an extra redirect.
Search-replace steps and a CSP upgrade header.
How to use the Mixed Content Checker
Click Load Example above to see a real result first.
Enter an HTTPS page
Start with the page that shows “Not secure” or a broken padlock.
Click “Check Mixed Content”
Tick “Scan up to 10 pages” to check more of the site.
Read the “Fix first” tab
Blocked active content comes first.
Fix and re-check
Run the search-replace, clear the cache and test again.
Common problems and how to fix them
| Problem | Why it matters | How to fix it |
|---|---|---|
| http:// images in posts | Padlock warning. | Search-replace http:// with https:// in the database. |
| http:// scripts or CSS | Blocked – page breaks. | Update theme/plugin settings to https://. |
| Hard-coded URLs in the theme | Returns after every update. | Use protocol-relative or https:// URLs in templates. |
| Third-party files without HTTPS | Cannot be upgraded. | Host the file yourself or use another provider. |
| Old Site URL setting | Generates http:// URLs. | Set both URLs to https:// in Settings > General. |
Frequently asked questions
What is the difference between active and passive mixed content?
Active content (scripts, CSS, iframes) can change the page, so browsers block it. Passive content (images, video, audio) is upgraded to HTTPS or blocked, and the padlock may be removed.
Does mixed content hurt SEO?
Indirectly. Broken layouts and “Not secure” warnings hurt user trust and engagement, and Google prefers secure pages.
Can a plugin fix mixed content?
Plugins like Really Simple SSL fix URLs on the fly, but a one-time database search-replace is cleaner and faster.
What does upgrade-insecure-requests do?
This Content-Security-Policy instruction tells browsers to load every http:// resource over https:// instead. It is a safety net, not a replacement for fixing the URLs.
Why do I still see warnings after fixing?
Clear your page cache, CDN cache and browser cache, then check again.
Related free tools
Built and maintained by the AM Digital Marketing Agency SEO team. Last updated: .
Want us to fix it for you?
Our team fixes technical SEO issues, speed and indexing problems – and optimizes your site for Google, AI Overviews and ChatGPT.