Free · without registration

Finding Insecure Resources on HTTPS Sites

Find HTTP references in an HTTPS page and their directly integrated style sheets. The result shows the affected resource, its use and the reference point for the correction.

Check the HTTPS page for HTTP references

What Does Mixed Content Mean?

An HTTPS page protects the transport of your HTML document. If it then loads scripts, images, style sheets or embedded content over HTTP, insecure integrations are created. Browsers treat these differently depending on the type of resource: Some requests are blocked, others are switched to HTTPS. Therefore, an HTTP reference found in the source code does not yet prove that the browser has actually transmitted unencrypted.

From Finding the Right Correction

Open the mentioned location in the template, CMS content or style sheet.
Check if the same resource is available under HTTPS and has a valid certificate.
Replace the address with the working HTTPS URL. In the case of own resources, a suitable relative path can also fit.
Empty affected page and asset caches and check again.
Control the browser console and network view, especially for dynamically reloaded content.

References to a service without working HTTPS cannot be repaired by simply replacing the protocol. Change the source or provide a permitted local copy.

What references does the checker record?

The evaluation takes into account, among other things, script and image sources, srcset, iframes, audio and video, posters, stylesheet links, and url() in simple CSS data. HTTP form destinations are named separately because data entered there may be affected. For HTML finds, the line number helps; for external CSS, the stylesheet address is specified.

Normal links to HTTP pages are not reloaded resources and therefore do not appear as a mixed content fund. One base-element is considered for relative addresses.

Limitations of the source text check

The URL retrieval includes a maximum of 1 MB HTML as well as six direct stylesheets with a total of 1 MB CSS. CSS imports, Shadow DOM and JavaScript-generated requests may be missing. CSS escapes and complex dynamic URL expressions are also not fully interpreted. A CSP with upgrade-insecure-requests can upgrade browser requests; the HTTP reference still remains visible as a source to be cleaned up. For certificate and forwarding there is the separate HTTPS Checker.

Frequent questions

Is an HTTP link on an HTTPS page already mixed content?

Not a normal text link alone. Relevant are integrated resources and separately the goals of forms.

Why does the tool show Finde even though my browser does not show a warning?

Browsers can automatically switch certain resources to HTTPS. The tool examines the specified source addresses and does not claim that every found resource was actually transferred over HTTP.

Are all subpages checked?

No. The entered page is checked with its directly linked style sheets. For other URLs, you each start your own check.

Can I check unpublished HTML?

Yes. In local mode, the inserted HTML text remains in the browser. Enter the planned page address so that relative URLs are resolved correctly.