Mixed Content Checker
Paste one URL and see whether its final (post-redirect) page is really secure: every http:// subresource in the markup is counted and split into "will be blocked" (scripts, styles, iframes) and "display only" (images…
More about this tool
media), with concrete examples in the details. The verdict tells you what to do — fix URLs, add a CSP safety net, or migrate the whole page to HTTPS if it never got there. The bulk version takes a whole list when you are auditing a site section or a client's template fleet.
How it works
- Type or paste one address (domain or URL).
- Press Check — the page opens the result right away.
- Read the verdict: green means fine, orange means attention, red means a problem; the recommendation tells you what to do.
Free: 30 fresh checks per hour from one IP; repeats within 10 minutes are served from cache and cost nothing.
Checking many domains at once?
The bulk version of this tool takes a whole list (one address per line), builds a live report and exports it to CSV.
FAQ
What exactly gets blocked by browsers?
Active mixed content — scripts, stylesheets, iframes, objects and fetch/XHR — is refused outright in every modern browser: the resource simply never loads. Passive content (images, video, audio, icons) is currently auto-upgraded to https:// when possible and otherwise shown with warnings; Chrome plans to block it fully. The report separates the two counts, so you know what breaks today and what will break tomorrow.
The page redirects to https:// — is that good enough?
For the page URL itself, yes: the checker follows redirects and judges the final scheme. But the markup of that final page is what gets scanned — a 301 to HTTPS does not fix a script tag that still says http://. The verdict reflects the state of the page users actually receive.
How do I fix mixed content?
Change the resource URLs to https:// (almost every CDN and asset host supports it), or drop the scheme entirely (//example.com/lib.js) so the page's own scheme is inherited — the first option is the more explicit one. A Content-Security-Policy with upgrade-insecure-requests buys time by auto-upgrading in the browser, but it is a bandage: fix the source URLs and keep CSP as a safety net. The examples in the row details are your exact fix list.
Does it find http:// URLs inside inline scripts or CSS?
Only markup-level references (src/href attributes and the like) are counted: those are what the browser loads directly and what defines mixed content. URLs constructed dynamically by JavaScript are invisible to any static check — run the page through your browser console (filter "mixed") for those.
Other quick checks
Domain Blacklist Checker (DNSBL)
Check if a domain or IP is blacklisted: Spamhaus, Barracuda, SpamCop, SORBS, SURBL — instant DNSBL lookup, free.
One domain — instant resultCache Headers Checker (Cache-Control)
Check the caching headers of any URL online: Cache-Control, max-age, ETag, Last-Modified, Expires — with a TTL verdict and fix recommendations.
One domain — instant resultHTTP Compression Checker (gzip, brotli)
Check whether any URL is served with gzip or brotli compression online, and see the measured byte savings for its real content.
One domain — instant resultDNS Lookup Tool — Check DNS Records
Look up DNS records of any domain online: A, AAAA, CNAME, MX, NS, TXT with TTLs, and query your own DNS server. Free and instant.
One domain — instant resultDomain Expiration Checker
Check when any domain expires: registrar, registration and expiration dates, days left and registry statuses via RDAP/WHOIS. Free and instant.
One domain — instant resultHTTP Status Code Checker
Check the HTTP status code of any URL online: redirects, the full redirect chain, the final URL and response time. Free and instant.
One domain — instant resultIndexability Checker (noindex, canonical)
Check if a page can be indexed: noindex meta and X-Robots-Tag, canonical URL, hreflang — the page's fate in search results.
One domain — instant resultSPF, DKIM, DMARC & MX Checker
Check mail records of any domain online: MX, SPF policy, DMARC policy and DKIM selectors — is the domain protected from spoofing?
One domain — instant resultMeta Tags Checker (Title, Description, H1)
Check the meta tags of any page online: Title and description lengths, H1, robots meta, canonical and hreflang. Free and instant.
One domain — instant resultOpen Graph & Twitter Cards Checker
Check the Open Graph and Twitter Cards tags of any page: og:title, og:image, twitter:card and more — is the share preview ready?
One domain — instant resultOutgoing & Broken Links Checker
Check external links of any page online: which are dofollow, how many are broken (4xx/5xx) — full list with statuses. Free and instant.
One domain — instant resultrobots.txt Checker and Validator
Check any site's robots.txt online: status code, size, Sitemap directives and whether it accidentally blocks all crawlers. Free and instant.
One domain — instant resultSecurity Headers Checker (HSTS, CSP)
Check the security headers of any site online: HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy and HTTPS redirect.
One domain — instant resultXML Sitemap Checker
Check any site's XML sitemap online: is it reachable and valid, how many URLs it has, how fresh its lastmod is, and whether the sitemap index children work.
One domain — instant resultSSL Certificate Checker
Check any domain's SSL certificate online: validity, issuer, expiry date, days left, hostname match and SAN list. Free, instant, no sign-up.
One domain — instant resultTTFB Test — Server Response Time Checker
Test the TTFB (time to first byte) of any URL online: DNS, connect and TTFB separately, HTML size and an A–F speed grade. Free and instant.
One domain — instant result