# Mixed Content & Cookie Inspector

Find the http:// scripts, styles, images and forms on an HTTPS page and what browsers do with each, and check every cookie the page sets for Secure, HttpOnly and SameSite.

Canonical: https://tamperbox.dev/mixed-content-checker

Reviewed: 2026-10-16

## Capabilities and processing

Enter the address of an HTTPS page, or paste its HTML. Put the response headers first, then a blank line, to check cookies from pasted input. For an address, our server fetches the page with up to 10 redirects and returns its headers and the first 512 KB of HTML, with cookie values removed. Pasted source is read in your browser.

Every `http://` address in the HTML is sorted by what browsers do with it: scripts, style sheets, frames, objects and fonts are blocked; images, audio and video are upgraded to `https://`; forms that post over HTTP show a warning before they send. Every Set-Cookie header, on redirects too, is checked for Secure, HttpOnly, SameSite, Domain, Path, lifetime, size and the `__Host-` and `__Secure-` prefix rules, with corrected Set-Cookie lines.

## Example workflow

The sample shop loads a chat widget over HTTP, which browsers block, shows a partner badge over HTTP, which browsers upgrade, and posts its newsletter form in plain text. Of its three cookies, one is rejected by browsers (SameSite=None without Secure) and one is readable by scripts.

## Limits and interpretation

Only the HTML as served is read: resources a script adds later, and addresses inside external style sheets, are not seen. Whether an upgraded address works over HTTPS is not tested. Cookie names that look like sessions are a hint, not proof. Nothing is stored.

## Related tools

[Security headers grader](https://tamperbox.dev/security-headers) · [Broken link checker](https://tamperbox.dev/broken-link-checker) · [Redirect chain checker](https://tamperbox.dev/redirect-checker) · [All tools](https://tamperbox.dev/) · [Privacy](https://tamperbox.dev/privacy)