What Is Mixed Content and Why Does It Break Your HTTPS Padlock?
Mixed content refers to a specific security condition on websites where the main page is delivered over a secure HTTPS connection, but one or more of the page's constituent resources — such as images, JavaScript files, CSS stylesheets, iframes, or form endpoints — are loaded over the unencrypted HTTP protocol. This combination of secure and insecure content within a single page creates what browser developers and security professionals call a "mixed content" situation, and it fundamentally undermines the security guarantees that HTTPS is supposed to provide. Our free online mixed content checker identifies every instance of this condition so you can eliminate it before it harms your visitors or your search rankings.
The reason mixed content is such a significant problem comes down to how HTTPS actually works. When a page is served over HTTPS, the entire communication between the server and the browser is encrypted, meaning that an attacker positioned anywhere on the network between the user and the server — at a coffee shop Wi-Fi access point, at an ISP, at a corporate network gateway, or anywhere else — cannot read or modify the data in transit. But the moment any resource on that page loads over unencrypted HTTP, that particular resource becomes vulnerable. An attacker could intercept the HTTP response and replace it with malicious content, injecting code that appears to come from your trusted HTTPS domain. This is why our mixed content detector tool free distinguishes not just whether mixed content is present, but what type it is and how severe the security risk it creates.
What Is the Difference Between Active and Passive Mixed Content?
Security researchers and browser developers have established a critical distinction between two categories of mixed content, each carrying very different risk profiles. Understanding this distinction is fundamental to prioritizing remediation efforts after running a scan website for non https links audit.
Active mixed content encompasses resources that can directly interact with and modify the Document Object Model (DOM) of the page. This includes JavaScript files loaded via <script> tags, CSS stylesheets loaded via <link rel="stylesheet">, iframes loaded via <iframe src="">, XMLHttpRequest and Fetch API calls, and <object> and <embed> elements. Active mixed content represents the highest level of risk because a compromised resource in any of these categories can execute arbitrary code in the context of your HTTPS page. An attacker who intercepts an HTTP JavaScript file can replace it with malicious code that steals session cookies, captures form inputs including passwords, redirects users to phishing sites, or performs actions on behalf of the user. Modern browsers handle this by completely blocking active mixed content rather than loading it with a warning, which means your page may be visually broken or functionally impaired even though users see the HTTPS padlock.
Passive mixed content includes resources that cannot modify DOM behavior but still compromise the privacy and integrity of the connection. Images loaded via <img> tags, audio and video loaded via media elements, and background images loaded through CSS are the primary examples. While an attacker who intercepts a passive HTTP resource cannot inject executable code into your page, they can substitute images with offensive or misleading content, they can track the user's browsing behavior by observing which resources are requested, and they can use the unencrypted channel to profile users and correlate browsing patterns. Browsers typically load passive mixed content with a degraded security indicator — the broken padlock or neutral shield icon — rather than blocking it entirely.
How Does the Mixed Resource Scanner Detect Insecure Content?
Our website mixed resource detector operates through a PHP server-side architecture that fetches the target page's HTML directly from the web server, then systematically parses that HTML to identify every external resource reference. This server-side approach eliminates the browser security restrictions that prevent client-side JavaScript tools from accessing cross-origin resources, giving us full visibility into the complete HTML source as the server delivers it.
The scanning engine applies a comprehensive set of regular expression patterns to extract resource URLs from all relevant HTML attributes. For standard resources, the scanner examines For each extracted URL, the scanner performs scheme analysis to determine whether the resource is loaded over HTTP or HTTPS. URLs beginning with A thorough free insecure content scanner needs to cover every category of resource that can appear in an HTML document. Our scanner covers the complete set of resource types that browsers load and that can carry mixed content risk. Script elements are the highest-priority detection target. Any JavaScript file loaded over HTTP from a script tag represents active mixed content that modern browsers will block, potentially breaking critical page functionality. Stylesheet link elements are similarly active content — an HTTP CSS file can contain Iframe elements deserve special attention because they embed entire web pages within your page, inheriting or potentially circumventing your HTTPS context. A frame loaded over HTTP creates a complete vector for man-in-the-middle content injection. Form action URLs deserve flagging because forms submitted over HTTP transmit their data — which may include sensitive user input — without encryption. Object and embed elements can load arbitrary content types including Flash (though largely deprecated), PDF viewers, and other plugins, all of which can be compromised if loaded over HTTP. Image detection through our scan site for insecure images capability covers both The padlock icon in the browser address bar is the primary visual signal that visitors use to assess a website's security. When mixed content is detected, browsers modify this indicator in ways that communicate degraded security. Chrome removes the padlock and replaces it with an info icon when passive mixed content is present. Firefox shows a padlock with a warning triangle. Older browsers may show a broken padlock or display a dialog asking whether to load the mixed content. Our fix broken lock icon free tool gives you the complete list of offending resources needed to restore the full security indicator. The remediation process for mixed content follows a consistent pattern regardless of the specific resources involved. The fundamental fix is to ensure all resource URLs use the HTTPS scheme rather than HTTP. For resources hosted on your own server, this typically means simply changing Content Management Systems require database-level fixes for mixed content, not just theme or template changes, because URLs are often stored in the database content fields. WordPress sites commonly have HTTP URLs stored in post_content fields that were added before the site moved to HTTPS. Plugins like Better Search Replace or WP-CLI commands can search and replace these database-stored HTTP URLs with their HTTPS equivalents. After running database replacements, use our check ssl mixed content online scanner to verify that all instances have been successfully updated. The relationship between mixed content, HTTPS status, and SEO rankings is multifaceted. Google confirmed HTTPS as a ranking signal and has been increasingly prioritizing secure sites in search results. While mixed content doesn't completely negate the HTTPS ranking signal — Google distinguishes between sites that are fully HTTPS versus those on HTTP — the user experience consequences of mixed content warnings have direct SEO impact through behavioral signals. When visitors encounter a browser security warning indicating mixed content, a significant portion of them leave immediately without engaging with the content. This increases bounce rate and reduces time-on-site metrics, both of which send negative engagement signals to search algorithms. Visitors who do stay may see broken page elements if active mixed content is blocked, creating a poor user experience that further depresses engagement metrics. For e-commerce sites specifically, security warnings on checkout pages or pages that collect personal information can completely destroy conversion rates as customers refuse to submit information on pages showing security indicators. Beyond organic search, mixed content warnings affect trust in ways that have compounding long-term consequences. Users who see security warnings on your site may associate your brand with poor security practices, reducing the likelihood of repeat visits or referrals. Marketing campaigns that drive traffic to pages with security warnings effectively waste advertising spend by sending visitors to pages that immediately undermine confidence. Our free secure site audit tool helps prevent these cascading trust failures by identifying mixed content before visitors ever encounter it. Regular scanning with a free web asset security scan should be incorporated into several recurring workflows. After any site migration from HTTP to HTTPS, a comprehensive mixed content audit is essential — migrations frequently leave behind hardcoded HTTP URLs in templates, plugins, database content, and configuration files that weren't caught during the migration process. Similarly, after installing or updating themes, plugins, or CMS versions, mixed content scanning catches new resource references that may have been introduced by the updated code. Deploying new content creates ongoing mixed content risk. Blog posts, landing pages, and product listings that include images or embeds added through a CMS editor can introduce HTTP resources if the editor doesn't enforce HTTPS. Content teams who copy and paste HTML from external sources or insert embed codes may inadvertently introduce HTTP resources without realizing the security implication. Our detect insecure elements on website tool supports ongoing content hygiene by enabling quick page-level checks whenever new content is published. Third-party widget and script changes represent another trigger for scanning. Analytics platforms, advertising networks, social media widgets, and customer chat tools frequently update their embed codes. A widget provider that migrated their CDN and updated their resource URLs might introduce HTTP references through an automated script update. Regular auditing with our check website for mixed content errors scanner catches these externally-introduced issues before users report them as security warnings. Browser developer tools, while invaluable for real-time debugging, have limitations for systematic mixed content auditing that server-side scanning overcomes. DevTools show mixed content warnings for resources that the browser actually attempts to load during a specific browsing session, which means dynamically loaded content, resources behind authentication, or content loaded by JavaScript execution may or may not appear depending on browser state, extensions, and user behavior during the session. Server-side scanning of the raw HTML source provides consistent, reproducible results that don't depend on session state or JavaScript execution environment. Our free mixed content validator approach also enables scanning of pages that require specific authentication contexts, staging environments, or pages that aren't easily browsed manually. By accepting direct HTML input in the HTML Source scanning mode, the tool can analyze page source obtained through any means — including pages behind login, pages returned by complex POST requests, or pages that only certain users can access — without requiring the scanning tool itself to authenticate or navigate complex user flows. The automation capability provided by our bulk scanning mode enables systematic security assessment at scale that would be impractical through manual browser-based checking. An agency auditing ten client sites, or a development team checking twenty pages before a deployment, benefits enormously from the ability to submit all URLs simultaneously and review structured results in a single interface. The exportable reports provide documentation suitable for security compliance requirements or client deliverables without manual data compilation.src attributes on script, img, iframe, audio, video, source, and embed elements; href attributes on link elements; data attributes on object elements; action attributes on form elements; and background attributes. Beyond standard HTML attributes, the scanner also detects resources embedded in CSS url()
http:// on a page served over https:// are flagged as mixed content. Relative URLs are resolved to absolute form using the page's base URL, then analyzed for scheme. Protocol-relative URLs (beginning with //) inherit the page's scheme and are therefore only flagged if the page itself is HTTP. This comprehensive approach makes our check mixed active content online tool accurate across the wide variety of URL formats that appear in real-world websites.What Types of Resources Does the Scanner Detect?
url() references or be used with JavaScript to inject dynamic styles. Our online mixed script checker flags both of these categories as active severity, signaling that they require immediate remediation.src attributes on img elements and background images specified through CSS properties. Images represent the most common type of passive mixed content and the most frequent source of broken padlock icons on HTTPS sites that have been recently migrated from HTTP. Audio and video source elements complete the passive content category, covering podcast players, video embeds, and other media that may reference HTTP-hosted media files.Why Does Mixed Content Cause the Broken Padlock Icon and How to Fix It?
http:// to https:// in the URLs — your server already serves them over HTTPS, and the only problem was the insecure URL reference. For resources hosted on external servers or CDNs, you need to verify that the external provider supports HTTPS (most modern CDNs and hosting providers do) and then update your URL references accordingly.How Does Mixed Content Affect SEO Rankings and User Trust?
When Should You Scan for Mixed Content?
What Makes Server-Side Scanning More Accurate Than Browser Dev Tools?