Mixed Content & Secure Context HTML Auditor
When an HTTPS page loads resources over HTTP, browsers silently block active content (scripts, stylesheets, iframes) and flag the page as "Not Secure." Paste your HTML and find every insecure reference — classified by severity — then export an HTTPS-fixed version in one click.
Tool interface
Audit Results
| Severity | Tag | Attribute | Insecure URL | Type |
|---|
HTTPS-Fixed HTML
Introduction
Migrating a site to HTTPS often leaves behind hardcoded http://
references buried in templates, CMS content, and legacy markup. These cause
mixed-content errors that break pages and remove the secure padlock. This auditor
finds every one and tells you which are dangerous.
How It Works
- The HTML is parsed with
DOMParser— no resources are actually fetched. - Every resource-bearing attribute is scanned:
src,href,srcset,action,data, and inline/block CSSurl(). - Each
http://reference is classified as active (critical) or passive (warning). - A fixed HTML export replaces every insecure URL with its HTTPS equivalent.
Privacy
Your HTML is parsed entirely in your browser. No resources are fetched and no content is transmitted. No API calls, no tracking.
Limitations
- Cannot detect mixed content injected dynamically by JavaScript after page load.
- The HTTPS-fixed export assumes the target server supports HTTPS; verify before deploying.
- Does not verify that each
https://URL actually resolves.
FAQ
Why do some resources break and others don't?
Browsers block "active" mixed content (scripts, stylesheets, iframes) because it can execute code and compromise the page. "Passive" content (images) is allowed but downgrades the security indicator.
Are protocol-relative URLs okay?
URLs starting with // inherit the page's scheme, so they're safe on HTTPS pages. However, explicit https:// is now preferred.
Is my HTML uploaded?
No. Everything is parsed locally in your browser. Nothing is transmitted.