X-RAY // WEB // MIXED

MIXED CONTENT AND SRI
CHECK.

Find scripts, CSS, frames, images and forms loaded over http:// on an HTTPS page, and external scripts without an SRI integrity check.

Runs only this check. For all 33 checks at once, use the full Domain X-Ray. Public lookups only; nothing is stored on the server.

MIXED

Mixed content and SRI

WAITING

Enter a domain above to run this check.

01 // WHAT THE CHECK VERIFIES

What the check verifies

Looks for resources loaded over http:// on an HTTPS page and for scripts from other domains without an integrity check (integrity attribute).

02 // WHY IT MATTERS

Why it matters

A script over HTTP is blocked by the browser or can be tampered with on the way. SRI guarantees that the file from another domain is the one you approved.

03 // HOW TO READ THE RESULT

What each result means

OK: No resource over HTTP in the initial HTML; external scripts without SRI show as information.
WARNING: Images or media loaded over HTTP.
FAIL: A script, CSS, frame or form over HTTP: the browser blocks it and the site may break.

ERROR and TIMEOUT mean the query did not finish (the source was down or slow), not a problem with the domain: run the check again.

04 // HOW TO FIX

How to fix

Change the addresses to https://. Meanwhile, upgrade-insecure-requests makes the browser try HTTPS. For scripts from other domains, pin the version and use SRI:

Content-Security-Policy: upgrade-insecure-requests

<script src="https://cdn.example.net/lib@1.2.3/lib.min.js"
        integrity="sha384-…" crossorigin="anonymous"></script>

Would rather have someone else do it? Bit Happens can fix this →

05 // CONTINUE

More checks in Website and HTTPS

Full Domain X-Ray: all 33 DNS, email, HTTPS, certificate and reputation checks at once →