To find HTTP resources on an HTTPS page, open the page in a browser, reload it with the developer console visible, and inspect its mixed-content warnings. Use the browser’s Security panel for page-level debugging; use a crawler or scanner to look for references across a larger site. Then fix the URL or source that generated each request and retest the affected page.
What a mixed-content checker should find
Mixed content occurs when an HTTPS page requests a subresource over HTTP or another insecure protocol. The page may have a secure address, but an insecure image, script, stylesheet, font, frame, media file, or API request can still expose data to observation or modification in transit. That weakens the protection HTTPS is meant to provide.
A mixed-content check should identify the page making the request and, ideally, the exact resource URL and resource type. A browser diagnostic reports requests observed during that visit. A crawler can search a broader set of pages for references, but a scan of static page content may not catch every request assembled by JavaScript or triggered only during a particular user journey.
Keep the scope clear: a normal link that takes a visitor from an HTTPS page to an HTTP page is navigation, not a mixed-content subresource request. An insecure download is a separate issue. This guide focuses on resources loaded into the HTTPS page.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Check one page in the browser
- Open the affected HTTPS URL. Use the same page and, if relevant, the same account state or user flow in which the missing content or warning occurs.
- Open the browser developer tools and show the Console. In Chrome, open DevTools before reloading so the page’s initial requests and warnings are visible.
- Reload the page. Look for mixed-content messages. Record the requesting page, the complete resource URL, and any indication that the browser upgraded or blocked the request.
- Inspect the Security panel. Chrome for Developers’ Lighthouse guidance points to the DevTools Security panel as a way to debug mixed-content problems.
- Check the Network panel if the warning is unclear. Filter or inspect requests and compare the requested scheme and status with the console message. This helps distinguish an insecure request from an unrelated 404, server error, or application failure.
Warnings may say that an HTTP request was upgraded to HTTPS or blocked. Those outcomes are different: an upgraded request can still fail if the host does not serve that resource successfully over HTTPS.
Scan more than one page
For a site-wide search, combine a recursive crawler or CLI scanner with browser checks on representative pages. MDN Web Docs names HTTPSChecker, mcdetect, and an online Mixed Content Checker as examples of checking approaches. Those names are examples, not endorsements or guarantees about their current maintenance, features, privacy, or pricing.
A crawler is useful for locating old HTTP references in pages, templates, and content. A browser is necessary to observe what the page actually requests at runtime. Neither method alone necessarily covers everything: a dynamically constructed URL, a request made after a click, or a resource behind authentication may not appear in a simple static scan. For important flows, visit the actual page in a browser and exercise the relevant interaction.
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
When reviewing results, capture these details for each finding:
Free tools Windows power users keep installed
One-click scans. No signup required.
- The HTTPS page that initiated the request.
- The full HTTP resource URL, including host and path.
- The resource type, such as script, image, stylesheet, iframe, font, media, or API request.
- Whether the browser upgraded, blocked, or loaded the request.
- Where the URL originates: page markup, CSS, a CMS field, a template, a plugin, or runtime code.
Understand whether the browser upgrades or blocks it
MDN Web Docs describes two current categories: upgradable content and blockable content. Browsers should automatically upgrade requests in the upgradable category from HTTP to HTTPS, and block requests in the blockable category. The result depends on resource type and URL details, so changing http: to https: is not a universal fix; the HTTPS endpoint must actually provide the resource.
Examples of upgradable content
MDN lists image src references (with exceptions involving srcset and <picture>), CSS image elements, audio, and video among upgradable content. If an upgraded image or media file disappears, check whether its host supports HTTPS and whether the exact path is available on that endpoint.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
Examples of blockable content
Scripts, stylesheets, iframes, fetch(), XMLHttpRequest, web fonts, and several CSS URL uses are among the blockable cases MDN describes. A request that might otherwise be upgraded is blocked if its host is an IP address. Do not assume that a browser will safely turn every HTTP reference into a working HTTPS request.
Because handling depends on the kind of resource, use the console’s actual result rather than relying on a rule of thumb based only on the URL scheme.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the source of each HTTP request
- Start with the exact finding. Match the URL and resource type from the console or scan to the page or code that produced it.
- For a first-party asset, make the resource available over HTTPS. Confirm the server, CDN, or asset host serves the file securely, then update the page, template, CMS content, or generated URL that points to it. For same-site resources, a relative URL or an explicit HTTPS URL can avoid retaining an old HTTP reference.
- For a third-party resource, check its provider’s HTTPS endpoint. If the provider serves the resource securely, change the reference and verify the exact asset works. If it does not, replace the resource with a secure alternative or remove it. Do not disable browser protection to make it appear.
- Retest the page and its behavior. Reload the affected URL, confirm the resource loads, and check that the mixed-content warning is gone. For a larger site, rerun the crawl and test representative dynamic user journeys in a browser.
Fixing only the visible URL may not be enough if a CMS, theme, plugin, stylesheet, or script keeps generating the HTTP address. Correct the underlying source so the problem does not return on other pages or after content is regenerated.
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
When to use Content Security Policy
The Content Security Policy directive upgrade-insecure-requests asks browsers to upgrade insecure requests. MDN says it can upgrade requests, including blockable mixed content. It can be a useful policy aid while you address old references, but it does not prove that the HTTPS destination exists or that the resource works. Keep correcting stale URLs and verify the secure endpoint.
Do not treat block-all-mixed-content as the modern primary fix. MDN marks that directive deprecated and says it is not needed with modern mixed-content handling. The durable remediation is to serve resources securely and remove or replace references that cannot be served over HTTPS.
Or skip the browser setup
For a visual capture of a page while you diagnose its layout, ScreenshotNeo can return a screenshot from one GET request. It is a screenshot API, not a mixed-content scanner: use the browser console or a crawler to identify HTTP requests, then use a capture to inspect the rendered result if useful. ScreenshotNeo’s cookie-banner, popup, and chat-widget cleanup is performed before capture; it does not replace DevTools evidence about which requests were blocked.
cURL:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://example.com -o shot.webpPython:
import requests
r = requests.get("https://api.screenshotneo.com/v1/shot", params={"access_key": "YOUR_API_KEY", "url": "https://example.com"}, timeout=90)
open("shot.webp", "wb").write(r.content)Node.js:
const q = new URLSearchParams({ access_key: 'YOUR_API_KEY', url: 'https://example.com' });
const res = await fetch(`https://api.screenshotneo.com/v1/shot?${q}`);See the ScreenshotNeo API documentation for request options. Cookie banners, popups, and chat widgets are removed before the shot; bot checks, blank pages, and failed loads are never billed; an MCP server lets AI agents take screenshots; and 1,000 screenshots a month are free with no card, with paid plans starting at $5 for 3,000. Sign up for ScreenshotNeo’s free plan.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Troubleshoot common mixed-content findings
- The browser says the request was upgraded, but the asset is still missing. Check that the host serves the same path over HTTPS and returns the expected resource. An upgrade changes the scheme; it does not create a secure endpoint.
- The request is blocked even though an image or media URL usually upgrades. Check its resource type, whether it uses a
srcsetor<picture>path, and whether the host is specified as an IP address. The category is not determined by the scheme alone. - The console is clean, but the crawler reports HTTP references. A reference may not have been requested during that browser visit, or browser handling may have upgraded it. Inspect the source URL and test the page or user flow that uses it.
- The page loads an insecure resource only after an interaction. Reproduce the interaction with DevTools open. Static scanning may miss runtime-generated requests; inspect the relevant application code or template as well.
- The warning returns after you edit the page. Search the CMS content, template, plugin, stylesheet, or URL-generation logic that supplies the reference. Correcting the originating value prevents it from being emitted again.
- The warning is gone but the page still looks wrong. Confirm the asset request succeeds and check for separate failures such as a missing file, authorization issue, or application error. A mixed-content fix does not guarantee that an asset itself is valid.
FAQ
Does a mixed-content warning mean the whole HTTPS page is unencrypted?
No. It means the HTTPS page requested at least one resource insecurely or that the browser handled such a request. The insecure subresource can still undermine the page’s protection, so identify and fix it rather than ignoring the warning.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
Will changing every HTTP URL to HTTPS solve the problem?
Only if each destination actually serves the requested resource over HTTPS and the browser permits that resource type. Verify the result in the browser after changing references.
Can a screenshot tell me which request caused the warning?
A screenshot shows rendered appearance, not the browser’s request-level mixed-content diagnostics. Use DevTools or a crawler to locate the request; a screenshot is supplementary visual evidence.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
