About this tool
Review bounded server-fetched HTML before HTTPS migrations, CDN changes, CMS releases, or launch QA without turning a static scan into a browser-runtime claim.
Mixed Content Checker fetches one public page through a bounded server endpoint and parses the final static HTML with a standards-compatible parser. It follows the first base href and separates current blockable or browser-upgradable HTTP subresources from forms, downloads, navigation, loopback, invalid, and protocol-relative review evidence.
- DNS-checks every destination, blocks private networks, and records up to five fetched responses, HTTPS-to-HTTP downgrades, status, content type, and CSP headers.
- Uses a standards-compatible HTML parser, the first base href, srcset candidates, CSS url() and quoted @import references, meta refresh, and meta CSP evidence.
- Separates current blockable and browser-upgradable mixed subresources from insecure forms, downloads, top-level navigation, loopback, invalid, and protocol-relative review evidence.
- Exports versioned JSON while making HTML, node, reference, response-size, redirect, and static-only limits explicit.
How to use Mixed Content Checker
Enter an absolute public HTTP or HTTPS URL and run the inspection. Check completeness and HTTPS applicability first, then review redirect downgrades, final status and content type, blockable references, upgradable media, insecure forms and downloads, base URL behavior, CSP clues, and the bounded reference evidence before exporting JSON.
When this tool is useful
- Before launching a new HTTPS site, domain migration, CMS theme, or CDN asset host.
- After importing old content where image, iframe, or script URLs may still use http://.
- When browser DevTools reports mixed content warnings and you need a shareable issue list.
Practical tips
- Resolve blockable scripts, stylesheets, iframes, objects, srcset, and CSS references before treating an upgradable image as harmless.
- Do not claim a clean page when the scan is partial, the final response is not explicit HTML over HTTP 200, or the final URL is not HTTPS.
- Use the fetched chain and first base href evidence to distinguish authored HTTP, redirect downgrade, and base-resolution problems.
Examples you can test
Load an example, compare the result with the expected output, then replace it with your own input.
Audit a migrated HTTPS page
Example input
https://www.example.com/pricing
Expected output
Completeness and HTTPS applicability, fetched response chain, blockable and upgradable counts, forms, downloads, CSP clues, and bounded static reference evidence
Confirm explicit HTML over HTTP 200 and a final HTTPS context before interpreting an empty mixed-subresource count as a bounded static pass.
Find old CMS image and iframe references
Example input
https://www.example.com/blog/legacy-post
Expected output
HTTP image, iframe, srcset, CSS url(), quoted @import, base href, meta refresh, and protocol-relative candidates grouped by current policy category
Static evidence can locate legacy markup, while JavaScript-generated and imported resource requests still need a browser or crawler trace.
Validation checklist
- Require complete evidence, a final HTTPS URL, explicit HTML content type, HTTP 200, and no redirect downgrade before accepting the bounded static result.
- Fix blockable scripts, stylesheets, iframes, objects, embeds, srcset candidates, and CSS URLs.
- Verify browser-upgraded image and media targets actually work over HTTPS instead of relying on automatic rewriting.
- Change insecure form actions and mixed downloads before collecting or delivering user data.
- Re-run the real page in supported browsers and inspect DevTools, CSP reports, runtime DOM, service workers, and subresource responses.