Find the http:// images, scripts and styles that stop your site showing a secure padlock.
🎁 Your first website check is free – every security tool works on it. Need unlimited checks? Go Pro
🔒 We load the homepage once, like a normal visitor.
How to use the mixed content checker
- Enter your domain.
- We load the homepage over HTTPS and scan its HTML.
- Change every listed http:// address to https://.
What is mixed content?
An HTTPS page that loads some files over plain HTTP. Browsers block insecure scripts, styles and frames (breaking the page) and show a warning instead of the padlock for insecure images.
Fixing it on WordPress
Set both addresses in Settings > General to https://, then run a database search-and-replace from http://yourdomain to https://yourdomain.
Frequently asked questions
Why doesn't my site show a padlock?
Usually mixed content or an invalid certificate. Run this checker and the SSL Checker.
Does it check every page?
It checks the homepage. Run it on other important URLs by entering them.
Are images a problem?
Browsers now auto-upgrade or warn about insecure images – fix them anyway.