Diagnostic instrument
Your HTTPS padlock is intact.
The certificate is valid.
Something else broke it.
Srccheck fetches any HTTPS page and lists every subresource loaded over plain http:// — scripts, stylesheets, images, iframes, fonts — classified by how the browser will treat each one. No rewriting, no judgment, no certificate check. Just the evidence.
What mixed content costs you
Blocked resources
Scripts and stylesheets loaded over HTTP are refused by every major browser. The page still loads; the feature that depends on that resource silently fails — analytics not reporting, styles not applying.
Downgraded padlock
Images, fonts, iframes and media loaded over HTTP trigger a downgraded security indicator. Chrome shows "Not secure." Firefox shows a broken padlock. The certificate is fine; the mixed content is the cause.
Clean — the diagnosis is the fix
Srccheck reports the exact URL, the line in the HTML, and the resource type. Because it tells you which URL and where it appears, you know exactly what to change: swap http:// to https:// or remove the embed. No investigation needed after the scan.
How it works
Paste an HTTPS URL — the page you want to check for mixed content. Srccheck only scans pages served over HTTPS, because mixed content is a problem that belongs to HTTPS pages exclusively.
Srccheck fetches and parses — the tool requests the page from the server, reads the HTML, and extracts every subresource URL from <script>, <link>, <img>, <iframe>, <video>, <audio>, <source>, and @font-face rules, resolving relative paths to absolute URLs.
Read the diagnosis — each HTTP subresource is listed with its full URL, the HTML fragment where it appeared, and a clear classification: blocked (scripts, stylesheets — browsers refuse to load them) or upgraded-or-warned (images, fonts, media — browsers may silently upgrade or show a downgraded padlock).
What Srccheck does not do
Srccheck does not check certificates, assess security posture, scan vulnerabilities, rewrite your HTML, or judge whether a third-party resource supports HTTPS. It reports what the page requests and how a browser will treat each one — nothing more.