Mixed Content Check
Find insecure HTTP asset and link references inside an HTTPS page.
Check your websiteWhy this check matters
HTTP subresources weaken transport security and may be upgraded or blocked by browsers. Active mixed content can break important scripts, forms, and user flows.
Passing evidence
<img src="https://cdn.example.com/chart.png" alt="Quarterly growth" />Common failing evidence
<script src="http://cdn.example.com/checkout.js"></script>Possible false positives
- A literal HTTP URL shown as documentation is not necessarily requested.
- Localhost development assets may be acceptable outside production.
How to fix it safely
- Replace insecure resource URLs at their source.
- Update CSS, manifests, and JavaScript-created requests as well as HTML.
- Remove third-party resources that do not support HTTPS.
How to verify the fix
- Load the page with the browser Network panel open.
- Confirm no requested resource or form destination uses HTTP.
Related Security checks
Run the complete audit
Check this signal together with the related category evidence on the current public page.
Open the security audit tool
