Your files stay on your device

Mixed content checker

Scan an HTTPS page's HTML for resources still referenced over plain http, split into blockable and passive content.

Enter an https:// page URL to scan its HTML.

The scanner reads the HTML exactly as the server delivered it, so resources injected by client-side JavaScript after load are out of scope, and it never executes the page's code. Before scanning it strips HTML comments and script and style element bodies, so their text is not misread as tags. It checks src, href, srcset, and poster attributes plus style attributes for plain-http references, and classifies them the way browsers do: scripts, stylesheets, frames, and objects are blockable, images, video, and audio are passive. Protocol-relative references, the ones that start with two slashes, are listed separately, since on an HTTPS page they load over HTTPS and only break if the page is ever served over HTTP. The proxy hands back at most the first 4,096 characters of the response, so a larger page is scanned on that prefix and the report says so. It does not fetch stylesheets or follow CSS imports, so http references inside CSS files are not counted.
Options

More web & auth tools

- HTTP header parser (/web/headers)
- CSP evaluator & builder (/web/csp)
All web & auth tools (/web)

Was this tool useful?
YesNo

Canonical HTML: https://nutter.tools/web/mixed-content-checker
Markdown version: https://nutter.tools/web/mixed-content-checker.md
Plain-text version: https://nutter.tools/web/mixed-content-checker.txt
Agent index: https://nutter.tools/llms.txt