Mixed Content Detector

You moved the site to HTTPS, the padlock came back with a warning, and the console keeps complaining about mixed content. What is missing is knowing which asset stayed on http. Paste the page HTML into the box — view-source output, a curl dump, or the template straight from your repo — and the tool lists what it found, numbered, as you type.

The scan is a regular expression looking for the src, href and action attributes followed by http://. Every hit lands in the list with the matched fragment. There is no URL field: nothing is fetched, nothing is uploaded, the analysis runs over the text you pasted. With an empty box the output already reads that nothing was found, which is just the initial state rather than a verdict about your site.

The result errs in both directions, and it helps to know where. An http href on an anchor tag shows up in the list, but a navigation link is not mixed content and browsers do not block it — the real trouble is images, scripts, stylesheets and iframes. Meanwhile it cannot see url(http://...) inside CSS, nor srcset, poster, or URLs assembled in JavaScript. Use it as a first sweep, then confirm in the browser console, which reports what was actually blocked.