Active mixed content
Scripts, stylesheets, iframes and similar executable or document resources are higher risk because changing them can alter page behavior.
<script src="http://example.com/app.js">
DeployPass / Mixed Content Checker
Free · No signup · Passive public checkFree Mixed Content Checker
Scan an HTTPS page for insecure HTTP images, scripts, stylesheets, iframes and other resource references. See exactly what needs attention before you deploy.
DeployPass fetches public HTML only. It does not log in, exploit the site, or execute browser attacks.
Checking page resources…
MIXED CONTENT SCORE
—/100
REVIEWMixed content review
0Resources
0HTTP resources
0Active
0Passive
Understand the result
Why mixed content matters.
Mixed content happens when an HTTPS page references a resource over plain HTTP. Browsers can block risky resources, downgrade user trust, or leave part of a page exposed to network modification.
Passive mixed content
Images, audio and video are generally less powerful than scripts, but HTTP delivery can still expose or alter what visitors receive.
<img src="http://example.com/image.jpg">
How to fix it
Prefer HTTPS URLs for every external resource. For your own assets, update hard-coded HTTP links and verify the resource is available securely.
https://example.com/resource
Relative URLs
Same-site relative URLs avoid hard-coding a protocol and normally inherit the HTTPS scheme of the page.
/assets/app.js
Important
A clean HTML scan is a strong signal, not a browser trace.
This focused checker reviews resource references visible in the fetched HTML. Resources injected later by JavaScript may require a real browser inspection. DeployPass reports what it can observe rather than claiming complete application security.
FAQ
Mixed content checker FAQ
What is mixed content?
Mixed content is an HTTPS page loading one or more resources with an insecure HTTP URL.
Which mixed content is most dangerous?
Scripts, stylesheets, iframes and other active resources generally deserve the highest priority because they can affect page behavior or content.
Does this checker execute JavaScript?
No. This version passively reviews public HTML resource references. Dynamically injected resources may not be visible.
How do I fix an HTTP resource?
Change it to a working HTTPS URL, host the asset securely yourself, or remove the dependency if no secure version exists.
Can I run a broader website security scan?
Yes. DeployPass also provides a full 19-check scan plus focused Security Headers, HSTS and CSP checkers.