Bulk Mixed Content Checker
A padlock in the address bar stops meaning "secure" the moment an HTTPS page pulls scripts, styles, iframes or images over plain http://.
More about this tool
Browsers call it mixed content and punish it in two tiers: active resources (scripts, stylesheets, iframes) are blocked outright — the page loses features or breaks silently; passive ones (images, media) are downgraded or flagged, and warnings leak into the console that clients love to forward. This bulk checker loads each URL from your list exactly like a browser would, follows redirects to the final scheme, and inspects the markup for insecure subresources: every http:// reference in script, style, iframe, image and media tags is counted, split into "will be blocked" and "display only", and quoted in the row details. The verdict is already prioritized for you: active mixed content is a problem to fix today (usually a hardcoded URL in a theme or an old embed), passive is a cleanup task. Pages that never made it to HTTPS get their own verdict — the migration itself is the fix. Export the report to CSV for a fix-ticket list.
How it works
- Paste up to 100 items, one per line. Duplicates are removed automatically.
- URLs without a scheme are checked over https://.
- The check runs in the background; the results page shows live progress.
- Filter the report by status code and export it to CSV.
Rate limit: 5 jobs per hour from one IP address. Results are stored for 7 days.
Checking many domains at once?
The result opens instantly — with a plain-language verdict, colored values and details on click.
FAQ
What exactly gets blocked by browsers?
Active mixed content — scripts, stylesheets, iframes, objects and fetch/XHR — is refused outright in every modern browser: the resource simply never loads. Passive content (images, video, audio, icons) is currently auto-upgraded to https:// when possible and otherwise shown with warnings; Chrome plans to block it fully. The report separates the two counts, so you know what breaks today and what will break tomorrow.
The page redirects to https:// — is that good enough?
For the page URL itself, yes: the checker follows redirects and judges the final scheme. But the markup of that final page is what gets scanned — a 301 to HTTPS does not fix a script tag that still says http://. The verdict reflects the state of the page users actually receive.
How do I fix mixed content?
Change the resource URLs to https:// (almost every CDN and asset host supports it), or drop the scheme entirely (//example.com/lib.js) so the page's own scheme is inherited — the first option is the more explicit one. A Content-Security-Policy with upgrade-insecure-requests buys time by auto-upgrading in the browser, but it is a bandage: fix the source URLs and keep CSP as a safety net. The examples in the row details are your exact fix list.
Does it find http:// URLs inside inline scripts or CSS?
Only markup-level references (src/href attributes and the like) are counted: those are what the browser loads directly and what defines mixed content. URLs constructed dynamically by JavaScript are invisible to any static check — run the page through your browser console (filter "mixed") for those.
Other tools
Bulk Domain Blacklist Checker (DNSBL)
Free bulk blacklist checker: paste domains and check them against Spamhaus, Barracuda, SpamCop, SORBS and SURBL in one run. Instantly see if your domain or IP is blacklisted. CSV export.
Accepts a list of domainsBulk Cache Headers Checker (Cache-Control)
Free bulk cache headers checker: paste URLs and audit Cache-Control, max-age, ETag, Last-Modified, Expires and Vary — with TTL verdicts and fix recommendations. CSV export.
Accepts a list of URLsBulk HTTP Compression Checker (gzip, brotli)
Free bulk compression checker: does each URL answer with gzip or brotli, and how many bytes it actually saves — uncompressed vs compressed size, per URL. CSV export.
Accepts a list of URLsBulk DNS Records Lookup (A, AAAA, MX, NS, TXT)
Free bulk DNS lookup with a custom DNS server option: paste domains and get A, AAAA, CNAME, MX, NS, TXT, SOA and SRV records grouped by type, one record per line with TTL, MX priorities, copy buttons and CSV export.
Accepts a list of domainsBulk Domain Expiration Checker (RDAP)
Free bulk domain expiry checker via RDAP with automatic WHOIS fallback: paste a list of domains and get the registrar, registration and expiration dates and days left for each. Domains expiring within 30 days are highlighted. Registry answers are cached for 24 hours. CSV export included.
Accepts a list of domainsBulk URL Status Checker
Free bulk URL status checker: paste up to 100 URLs and get HTTP status codes, redirect chains, final URLs and response times. Export the results to CSV.
Accepts a list of URLsBulk Indexability Checker (noindex, X-Robots-Tag, canonical)
Free bulk indexability checker: paste URLs and detect noindex meta tags, X-Robots-Tag headers, nofollow, canonical and hreflang. Export the crawl audit to CSV.
Accepts a list of URLsBulk Mail Records Checker (SPF, DKIM, DMARC, MX)
Free bulk mail records checker: paste domains and audit SPF, DKIM, DMARC policies and MX records. Make sure your domains can send mail and cannot be spoofed. CSV export.
Accepts a list of domainsBulk Meta Tags Checker (Title, Description, H1)
Free bulk meta tags checker: paste URLs and get Title, meta description, H1 and heading counts with length checks and duplicate detection. Export the SEO audit to CSV.
Accepts a list of URLsBulk Open Graph & Twitter Cards Checker
Free bulk Open Graph checker: paste URLs and audit og:title, og:description, og:image, twitter:card and more social preview tags. Export the report to CSV.
Accepts a list of URLsBulk Outgoing Links & Broken Links Checker
Free bulk outgoing links checker: paste URLs to count external and internal links, dofollow vs nofollow, and find broken links (404, 5xx, dead domains). Export the audit to CSV.
Accepts a list of URLsBulk robots.txt Checker
Free bulk robots.txt checker: paste a list of domains and see the status of /robots.txt, redirect count, file size, the number of Sitemap directives and whether all crawlers are blocked. CSV export included.
Accepts a list of domainsBulk Security Headers Checker (HSTS, CSP)
Free bulk security headers checker: paste domains and audit HSTS, X-Content-Type-Options, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy and the HTTPS redirect. CSV export.
Accepts a list of domainsBulk XML Sitemap Checker
Free bulk sitemap checker: find the XML sitemap of every domain (via robots.txt or default paths), validate it, count URLs, check lastmod freshness and sitemap indexes. CSV export.
Accepts a list of domainsBulk SSL Certificate Checker
Free bulk SSL certificate checker: paste a list of domains and instantly see the certificate subject, issuer, hostname match, expiry date and days left before renewal. Find expiring certificates before they become incidents. CSV export included.
Accepts a list of domainsBulk TTFB & Speed Checker
Free bulk TTFB checker: paste a list of URLs and measure time to first byte, total response time and HTML size for each page. Export the report to CSV.
Accepts a list of URLs