Does your secure page load anything over plain HTTP?
The mixed content check reads the original HTML of your secure pages for scripts, images and other files at plain http addresses. Each one weakens the encrypted page around it.
What does this check look at?
It looks at whether a secure page declares scripts, images or other files at plain HTTP addresses in its original HTML. It reads image sets, media posters and declared preloads as well as script and link tags. MDN warns that scripts are particularly dangerous because they can modify any aspect of the page.
Pulse and Deep scans both run it.
What does a result mean?
| What the report shows | What it means | What to do |
|---|---|---|
| Pass | No plain http file addresses were declared in the HTML read. | Nothing. |
| Attention | At least one http file address was declared. | Change it to https, or host the file yourself. |
| Not tested | The page HTML was not available, for example a page built entirely in the browser. | Nothing to act on. |
It does not watch what the browser loads later, so files that scripts or stylesheets add are not covered. Browsers often block or upgrade these files, so the page may look fine while the reference stays in the code. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.
How serious is a finding?
Treat this as a hardening gap. It makes an attacker’s job easier but gives them no path of its own, so fix it after anything more direct. Confidence starts low, because it is inferred from headers or declarations rather than shown directly. The report lists what to fix by how directly someone could use it, not by the severity label.
What does a confirmed finding have to show?
| Part | For this check |
|---|---|
| Where it starts | Someone on the visitor's network |
| The protection that should stop it | The page loads content or sends forms without HTTPS |
| What is reached | Content or form data in transit |
| What follows | A hardening gap; no interception was attempted |
Which standards does it relate to?
| Standard | Reference |
|---|---|
| OWASP Top Ten | A04:2025 Cryptographic Failures |
| CWE | CWE-319 |
| ASVS | v5.0.0-12.2.1 |
Each one is a related control, not a verification. A scan sees what anyone online can see, so it never proves a whole requirement is met.
Fix it with your AI
The fix is usually a find and replace, plus checking each file still loads from its https address.
Find every script, stylesheet, image, font, video or iframe in my site that is loaded from an http:// address. Change each one to https:// if the same file is available there, or download and host it with the site if it is not. Show me the list of addresses you changed and any you could not fix.How to check
Say Atlas, our example app at atlas.example, loads its logo from an old http image host. The check names the reference, and the fix is one changed address.
The free quick check covers this on your homepage with no account, and a Pulse scan from your account adds your scripts and public records. Pulse or Deep explains the difference.
Questions people ask
My page looks fine in the browser. Why does this flag?
Modern browsers often upgrade or block insecure files quietly. The reference is still in your code, and some browsers or files are not upgraded.
Are images as risky as scripts?
Less so. A changed script can rewrite the whole page, while a changed image can only mislead. Both are worth fixing.
See what your site shows from outside
A quick check reads your homepage the way a visitor would and gives you a score. No account needed.
Check your siteSources
- How we rate findings Lockpick docs, read on October 7, 2026
- Mixed content MDN Web Docs, read on October 7, 2026