Find the insecure resources and weak cookies on an HTTPS page.
Example
Insecure addresses
Cookies
Corrected Set-Cookie lines
Findings
Capabilities and processing
Enter the address of an HTTPS page, or paste its HTML. Put the response headers first, then a blank line, to check cookies from pasted input. For an address, our server fetches the page with up to 10 redirects and returns its headers and the first 512 KB of HTML, with cookie values removed. Pasted source is read in your browser.
Every http:// address in the HTML is sorted by what browsers do with it: scripts, style sheets, frames, objects and fonts are blocked; images, audio and video are upgraded to https://; forms that post over HTTP show a warning before they send. Every Set-Cookie header, on redirects too, is checked for Secure, HttpOnly, SameSite, Domain, Path, lifetime, size and the __Host- and __Secure- prefix rules, with corrected Set-Cookie lines.
Example workflow
The sample shop loads a chat widget over HTTP, which browsers block, shows a partner badge over HTTP, which browsers upgrade, and posts its newsletter form in plain text. Of its three cookies, one is rejected by browsers (SameSite=None without Secure) and one is readable by scripts.
Limits and interpretation
Only the HTML as served is read: resources a script adds later, and addresses inside external style sheets, are not seen. Whether an upgraded address works over HTTPS is not tested. Cookie names that look like sessions are a hint, not proof. Nothing is stored.
Related tools
Security headers grader · Broken link checker · Redirect chain checker · All tools · Privacy