Mixed Content Checker
Hard-coded http:// resource references on an HTTPS page.
This is one independent signal used by the Domain Security Score, and can also be run on its own for any domain.
Based on: W3C Mixed Content
About this validation
Hard-coded http:// resource references on an HTTPS page.
- Protocol / standard:
- Rules reviewed:
- Sep 6, 2026
SEOTechTests methodology: Data source: a live page fetch performed by SEOTechTests, scanning for hard-coded http:// resource references. Standard: the W3C Mixed Content specification defines how browsers classify and block/warn on such requests.
Standards and vendor-documented behavior can change. This reflects the source as last reviewed above, not a permanent guarantee.
FAQ
What is mixed content?
An HTTPS page that loads a resource (script, stylesheet, image) over plain, unencrypted HTTP -- browsers block the riskiest kinds (like scripts) outright and may warn about the rest.
Why does mixed content matter for security?
An HTTP resource on an otherwise-encrypted page can be intercepted or altered in transit by a network attacker, undermining the protection HTTPS is supposed to provide for the whole page.
Does this check load the page in a real browser?
It scans the fetched page's markup for hard-coded http:// references -- it does not require actually running the page in a browser engine to flag this specific class of issue.
Is any mixed content finding automatically severe?
Severity is scaled by resource type -- an actively blocked resource type (like a script) is more consequential than a merely-warned-about one (like an image), since a blocked resource can also break page functionality.