Web Security

Mixed Content Scanner

Finds http:// and protocol-relative resources in HTML and separates the active loads a browser blocks from passive ones.

Loading the tool…

Processing happens locally in your browser. What you paste or load is processed by this page and is not uploaded to a server. Nothing is stored unless you use a control that says it stores something, and you can clear anything this site has kept from the privacy page.

How to use this tool

  1. Paste the page HTML, or the fragment you are checking.
  2. Select Scan markup.
  3. Fix the active rows first - scripts, stylesheets, iframes and form actions are blocked outright on an HTTPS page.
  4. Switch protocol-relative URLs to explicit https:// so they never resolve to http.

What mixed content scanner does

An HTTPS page that pulls a script or stylesheet over plain http is a mixed-content page, and the browser treats it seriously: active content - scripts, stylesheets, iframes, form posts - is blocked outright, because it can rewrite the page. Passive content such as images is blocked or flagged. The result is a page that half-works in a way that is hard to diagnose from the console alone.

Paste the page markup and this lists every http:// and protocol-relative resource it finds, grouped by how the browser treats it, so the urgent active loads are separated from the passive ones. It reads the markup as text and never fetches any of the URLs inside it. It runs entirely in your browser - nothing you paste is sent anywhere, and this tool does not contact, scan or attack any website. Only review systems you own or are authorised to assess.

Frequently asked questions

Active content - scripts, stylesheets, iframes, form posts, plugins - can rewrite the page, so browsers block it outright on an HTTPS page. Passive content such as images and media is blocked or shown with a warning. The active ones are the urgent fixes, and the scanner separates them.

No. It reads the markup you paste as text and reports the http:// and protocol-relative references in it. It never requests any of those URLs, so scanning a page causes no traffic to it.

A //host/path URL inherits the page protocol, so on an https page it is secure - but on an http page, or when the file is opened locally, it resolves to http and becomes mixed content. An explicit https:// avoids the ambiguity.