How to Find and Fix Mixed Content Warnings in 2026

📅 June 8, 2026 • ⏱️ 7 min read | By SSL Checker Tool Team

Mixed content occurs when an HTTPS page loads resources (images, scripts, stylesheets, iframes, API calls) over HTTP. Browsers either block these resources entirely (active mixed content) or load them with a warning (passive mixed content). Both cause Chrome to remove the padlock icon, replacing it with a warning triangle. In Chrome 94+, active mixed content is blocked by default — your JavaScript and CSS will simply fail to load.

🔄

Redirect Checker

Trace your redirect chain to ensure all hops go through HTTPS cleanly.

Try It Free →

Step 1: Find Mixed Content with Chrome DevTools

⚠ https://yourdomain.com/page

How to open Chrome DevTools Console: Press F12 → click "Console" tab

⚠ Mixed Content: The page at 'https://yourdomain.com/' was loaded over HTTPS, but requested an insecure image 'http://cdn.example.com/logo.png'. This content should also be served over HTTPS.

✗ Mixed Content: The page at 'https://yourdomain.com/' was loaded over HTTPS, but requested an insecure script 'http://analytics.example.com/track.js'. This request has been blocked; the content must be served over HTTPS.

ⓘ Upgrade your insecure requests with: <meta http-equiv="Content-Security-Policy" content="upgrade-insecure-requests">

Each Console warning shows the exact URL causing the issue. Write them all down before fixing.

Step 2: Scan for Mixed Content Programmatically

For sites with many pages, manual DevTools inspection doesn't scale. Use these methods to find all mixed content sources:

# Scan your HTML source for HTTP URLs:
# (replace /var/www/html with your web root)
grep -r "http://" /var/www/html --include="*.html" --include="*.php" \
  --include="*.js" --include="*.css" \
  | grep -v "https://" \
  | grep -v "localhost" \
  | grep -v "//:" \
  | grep -v "