How to Find Mixed Content on an HTTPS Page
https://vulnify.app/blog/how-to-find-mixed-content-https

Fetch a page with Vulnify’s Mixed Content Checker. Read script and image HTTP counts, fix the URLs you control, and run the check again.

The padlock is on, and the page still asks the browser to load a script or an image over plain HTTP. That is mixed content. Browsers treat an HTTP script on an HTTPS page as a break in the lock. An HTTP image is quieter, and still wrong. Vulnify’s Mixed Content Checker fetches the HTML and counts those references. It does not open a browser console, and it does not run the page’s JavaScript. Run the check Open the checker and enter one HTTPS URL. The field wants a full URL. Leave Mode on Quick. Quick is public. Comprehensive asks you to sign in, and choosing it while logged out sends you to register. Stack is Generic, Nginx, Apache, Cloudflare, Express, Joomla, Next.js, or WordPress. Choose the one you deploy so later remediation can be phrased for it. The stack does not change the fetch. The button is Run Quick Check. The tool requests the HTML of that URL. It looks for http:// inside src and href attributes. It does not execute scripts, so a URL injected by JavaScript after load will not appear. Read active and passive counts The finding, when there is one, is titled “HTTP resources detected on page.” Severity is high if any script source is HTTP. Otherwise it is medium. The details split the counts. Active count is script src only. Those are the ones that can change the page. Passive count is img src only. A stylesheet over HTTP is mentioned in the remediation, but it is not part of the active count. Do not treat the active number as “everything that is not an image.” A clean fetch is titled “No obvious mixed-content references found.” The grade is A when there are no matches, and C when there are. Clean means the fetched HTML had no obvious http:// in those attributes. It does not mean the browser console is empty, and it does not mean a later script did not add an HTTP URL. What a clean result does not see If the HTTP URL is built in JavaScript, this check will not see it. If the bad reference is on a second page, you have to point the checker at that page. One homepage result is one page. Fix the URLs you control. Change http:// asset links to https:// , or to a path on the same origin. Then run the same URL again in the same mode. The mixed-content fix notes are the short version of that change. Transport problems that are not mixed content, such as an expiring certificate or a weak protocol, belong on the SSL and TLS article , not here. A checkout page and a blog template Start with the URL a customer actually loads. A checkout that “works” in Firefox and shows a warning in Chrome is often one script tag left on http:// by a payment snippet someone pasted in 2019. Run the checker on that checkout URL. If the active count is greater than zero, the finding is high, and the title is “HTTP resources detected on page.” That script is the one to change first. An image in the passive count can wait until the script is HTTPS. A blog template is the other pattern. The article HTML is fine. The layout still points a logo or a font stylesheet at an old CDN over HTTP. Remember the split: the active count is scripts only. A stylesheet is called out in the remediation and is not in that active number. Open the HTML, search for http:// , and do not stop when the script count hits zero. Fix the URLs you control. A third-party widget that only offers HTTP is not something this checker can rewrite. You either stop loading it or you put it behind a host you serve over HTTPS. Then run the same URL again, in the same mode, and look for the clean title: “No obvious mixed-content references found.” The grade moves from C to A when the matches are gone. Quick, then the page you actually care about Start with the URL a customer loads. If that page is clean and a template still embeds an old CDN link, test the template’s URL too. Comprehensive is the signed-in mode on this same tool. It is still an HTML fetch of the URL you entered, not a crawl of the whole site and not a browser. Frequently asked questions Does the checker execute JavaScript? No. It fetches HTML and counts http:// values in src and href. A URL added by script after the page loads is outside this check. Is an image as urgent as a script? No. A script source over HTTP makes the finding high. Image sources are the passive count and, without a script match, the finding is medium. Does a clean result mean the browser console is clean? No. Clean means the fetched HTML had no obvious mixed-content references. The console can still show a request this fetch never saw.