What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
To find HTTP resources on an HTTPS page, open the page in a browser, reload it with DevTools open, and inspect the Console and Security panel for mixed-content requests. For site-wide coverage, add a crawl or reference scan, then test affected pages and user journeys in a browser: a crawler may find stored HTTP URLs but miss requests created at runtime.
What a mixed-content checker looks for
Mixed content occurs when a page loaded over HTTPS requests a resource over HTTP or another insecure protocol. The page may have a secure address and still contain insecure images, scripts, stylesheets, frames, fonts, media, or requests to an API. Those insecure requests can expose data to observation or modification in transit, weakening the security HTTPS is meant to provide. MDN Web Docs describes the current browser handling and resource categories in its “Mixed content – Security” documentation, last modified August 15, 2026.
A checker should help you answer three questions: which HTTPS page made the request, what exact resource URL was requested, and what the browser did with it. A browser’s own diagnostics are best for requests observed during that visit. A crawler or static scan can cover more pages and find references in stored content, but does not necessarily execute every script or reproduce every user interaction.
Check one page in Chrome DevTools
- Open the affected page using its HTTPS address. Confirm the address bar shows HTTPS; otherwise you are not diagnosing mixed content on a secure page.
- Open DevTools before reloading. In Chrome, use the browser menu’s More tools > Developer tools, or the applicable keyboard shortcut for your operating system. Select the Console tab.
- Reload the page. Reloading with the Console visible makes it easier to catch requests made during startup. Reproduce the action that reveals the missing element, too—for example, opening a menu or submitting a form—because a request may only happen after interaction.
- Read the warning, not just the page appearance. Record the HTTPS page URL, the exact HTTP resource URL, and the resource type if shown. Note whether the browser says the request was upgraded or blocked.
- Inspect the Security panel. Chrome for Developers’ Lighthouse guidance, “Does not use HTTPS” (last updated April 16, 2024), points to the DevTools Security panel for debugging mixed-content problems. Use it alongside Console messages rather than treating a visual symptom as proof of the specific cause.
Keep the full requested URL, including its hostname and path. It can tell you whether the stale reference is to your own asset host, a CDN, an embedded third-party service, or a dynamically constructed endpoint. If multiple pages show the same resource URL, look for a shared template or common content field rather than editing each page independently.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →#1 Best Overall
- Comes with secure packaging
- It can be a gift item
- Easy to read text
Scan more than one page
A one-page browser check answers what happened during that visit; it does not establish that the rest of a site is clean. For a larger site, combine a recursive crawl or CLI scan with browser checks of important pages. MDN’s mixed-content documentation names HTTPSChecker, mcdetect, and an online Mixed Content Checker as examples of ways to check. Those examples are not a guarantee of current maintenance, features, pricing, privacy practices, or availability.
- Use a crawl or reference scan to find HTTP references across accessible pages, templates, and stored content. Check that the report identifies both the page containing or requesting the reference and the resource URL.
- Use the browser on representative routes to catch runtime requests, including content loaded by JavaScript, lazy-loaded elements, and interactions. Static scans can miss URLs assembled at runtime or pages that require authentication.
- Include authenticated and stateful flows where relevant. A public crawl may not see an account-only page, a consent-dependent element, or a request triggered only after a user action. Check those flows in the browser with the same access and interaction that exposes the problem.
- Repeat the scan after changes. Recheck the affected pages and sample the journeys that matter. A clean crawl alone does not demonstrate that every runtime path is clean.
Choose the method based on the question. Browser diagnostics show requests made by a particular page in a real browser session; a crawl can broaden coverage but depends on what it can discover and execute. Neither result should be overstated as proof that every possible state and route was tested.
Understand whether the browser upgraded or blocked the request
Modern handling distinguishes upgradable content from blockable content. Browsers should automatically upgrade certain request types from HTTP to HTTPS and block blockable mixed-content requests. An upgrade is not evidence that all HTTP resources are permitted, and it only works if the HTTPS endpoint actually serves the requested asset. MDN also notes that a request that might otherwise be upgraded is blocked when its host is an IP address.
- Examples of upgradable content: image
srcreferences (with exceptions involvingsrcsetand<picture>), CSS image elements, audio, and video. - Examples of blockable content: scripts, stylesheets, iframes,
fetch(), XMLHttpRequest, web fonts, and several CSS URL uses.
These are examples, not a complete substitute for reading the actual browser message: classification can depend on resource type and URL details. Replacing http: with https: may fail if the remote host does not offer that asset over HTTPS, or if the path, redirects, or server configuration differ.
Fix the reference at its source
- Identify the owner of the resource. Use its hostname and path to determine whether it is served by your site, your CDN, or another provider.
- For a first-party asset, make HTTPS the working source. Configure the server or CDN to serve the file over HTTPS, then update the HTML, stylesheet, CMS content, template, or generated URL that points to it. For same-site references, an explicit HTTPS URL or a suitable relative URL avoids a hard-coded HTTP scheme.
- For a third-party resource, check its HTTPS endpoint. If the provider serves the resource securely, change the reference and verify that the new URL returns the intended asset. If no secure version is available, replace the dependency with a secure alternative or remove it.
- Retest the page and the feature. Confirm that the resource loads as intended and that the browser no longer reports the mixed-content request. A page that looks complete is not enough if a script, API call, or less-visible interaction still fails.
- Search for the same source elsewhere. When the reference came from a reusable template, CMS record, or shared stylesheet, check other pages using it and rerun the broader scan.
Do not disable browser protection to make a broken page appear to work. That hides the signal while leaving the insecure request in place. Likewise, do not assume that a browser-upgraded image means the source URL has been corrected; fix stale references so behavior does not depend on automatic upgrading.
Where Content Security Policy fits
The CSP directive upgrade-insecure-requests asks the browser to upgrade insecure requests to HTTPS. MDN says it can upgrade requests including blockable mixed content, so it can help as a site policy while you address stale references. It is not a substitute for ensuring that secure versions of resources exist and checking that the site still works after the policy is applied.
For example, a response policy can include this directive:
Content-Security-Policy: upgrade-insecure-requestsApply policy changes deliberately and test the pages and integrations that rely on external resources. If an endpoint has no working HTTPS version, upgrading its URL cannot make that endpoint secure or available. MDN marks block-all-mixed-content deprecated and says it is not needed for modern handling; do not make it the main remediation strategy.
Free tools Windows power users keep installed
One-click scans. No signup required.
What is—and is not—a mixed-content finding
The scope is an insecure resource loaded into an HTTPS page. A regular link that navigates the top-level page to an HTTP destination is not itself a mixed-content subresource request, though linking to an insecure destination can still be a separate security concern. Mixed downloads are also distinct: a file download can raise an insecure-download warning without being an embedded resource request. Diagnose those cases on their own rather than treating every visible HTTP URL as the same kind of mixed-content issue.
Troubleshoot common results
The page looks broken, but the Console has no warning
Reproduce the action that reveals the problem and reload with DevTools open. The resource may be requested only after interaction, or the visible issue may have another cause. Check the Network activity and the Security panel, then use the observed request URL rather than guessing from the appearance.
The warning says the request was upgraded, but the asset is still missing
Check whether the HTTPS host serves the same path and whether the request succeeds. An automatic upgrade changes the scheme, not the server’s content or configuration. Update the reference to a confirmed secure URL or choose another resource.
A request is blocked even though you changed it to HTTPS
Verify the final URL after redirects and confirm that the host presents the resource over HTTPS. Check for a wrong path, a provider that does not support HTTPS for that asset, or a request made to an IP-address host. Use the browser’s reported URL and resource type to narrow the cause.
Rank #4
- Bug Bounty Bootcamp: The Guide to Finding and Reporting Web Vulnerabilities
- No Starch Press
- ABIS BOOK
A crawler reports HTTP, but the page seems fine in a browser
Determine whether the crawler found a stored reference that the browser did not use in that session, or whether the browser upgraded it. Inspect the particular page and resource in DevTools, then fix stale source references where appropriate rather than relying on the discrepancy.
The scan is clean, but a user still sees a warning
Check routes the crawler could not access, authenticated pages, JavaScript-generated URLs, lazy-loaded resources, and user actions not covered by the crawl. Reproduce the reported flow in a browser and inspect the request as it occurs.
The policy fixes some requests but breaks a feature
Find the endpoint that cannot serve the upgraded request over HTTPS. Replace or remove that dependency, or correct its HTTPS configuration; do not treat a CSP directive as a way to make an HTTP-only service compatible with HTTPS.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Or skip the browser setup
ScreenshotNeo is a screenshot API, not a mixed-content checker: it will not identify or repair an HTTP reference. After you have corrected a page, a screenshot can help you inspect its rendered appearance. For the actual mixed-content diagnosis, use DevTools and a crawl as described above.
Best Value
A one-call capture example is below; see the ScreenshotNeo API documentation for request options:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpScreenshotNeo removes cookie/consent banners, newsletter popups, and chat widgets before capture; bot checks, blank pages, and failed loads are never billed; and its MCP server lets AI agents take screenshots. The Free plan includes 1,000 screenshots a month with no card, and paid plans start at $5 for 3,000. Sign up free for ScreenshotNeo.
Performance, coverage, and cost considerations
Browser inspection has little setup and shows actual browser handling, but it covers only the pages and states you visit. A recursive crawl can make broad checking more practical on a large site, while its coverage depends on crawl access and its ability to discover pages and references. A CLI scan can fit into a repeatable workflow, but a static URL search cannot by itself establish whether a dynamically created request is made or how a browser handles it.
Plan coverage rather than assuming any one checker is exhaustive: include key templates, high-impact pages, login-required routes, and interactions that load external content. Keep a record of the page, resource URL, resource type, and observed browser outcome so fixes can be verified. No prevalence percentage, incident rate, or universal scan duration follows from the available technical guidance; actual effort depends on site size, access, and dynamic behavior.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
