An https page that pulls a single image, script, or stylesheet over http:// can lose its padlock or have that asset blocked. Hoppla reads the HTML of the https page you monitor, finds the http:// resources in the markup, and lists the offenders by URL while the page still looks fine to you. One more check on the same monitor as uptime and SSL. No separate scanner, nothing to install.
shop.acme.io https → 3 http:// assets (img×2, script×1) WARNING
Fictional values. Not a live measurement.
On the https page you monitor, Hoppla parses the served HTML for any resource still loaded over http://: image, script, stylesheet, iframe, video, audio, source, embed, object, or form action. It also reaches into url(http://...) references inside inline <style> blocks and style attributes, where insecure background images love to hide. Resources added later by JavaScript aren't in the served HTML, so they aren't seen. You get the first 100 offenders by URL plus the full count, so you know which asset breaks the padlock. One catch worth saying out loud: it's advisory. A warning, never a downtime incident, because a page with mixed content still loads.
Mixed content can't exist on an http page, so Hoppla checks the scheme first. Served over https? The scan runs. Plain http? Nothing to flag, and the check reports OK.
Hoppla walks the markup for the usual places a resource loads: img/src, script/src, stylesheet link/href, iframe/src, video, audio and source/src, embed/src, object/data, form/action. Then it goes one layer deeper, into url(http://...) inside inline <style> blocks and style attributes, the spots a quick devtools glance tends to miss.
Every resource pointing at http:// gets collected. Hoppla shows the first 100 by their actual URL so you can fix the source line, and reports the total when there are more. No vague 'mixed content detected'. You get the addresses.
Find one http:// resource and the check resolves to WARNING, landing on the monitor's timeline next to uptime, SSL, and the rest. It never fires a downtime incident. The page still works, it just isn't fully secure yet.
A single image, tracker, or stylesheet over http:// can drop the padlock or get that asset blocked. Hoppla finds the one offender on a page full of correct https links, so 'mostly secure' is less likely to ship by accident.
The scan lists the first 100 offending resources by their real address and reports the total. Fix the source line instead of crawling devtools. And the count tells you whether one bad asset is really fifty templated copies of the same one.
Mixed content isn't downtime, so it never pages you for an outage. It's a warning on the same timeline as every other check, an honest signal that the page loads but the lock is broken.
You moved your landing page to https months ago and stopped thinking about it. But one hero image still points at http://, so the padlock is gray for every first-time visitor. You've never seen it, because your browser cached the secure version. Hoppla scans the live page and hands you the exact image URL, so you can fix it before more prospects spot the 'not secure' bar and close the tab.
A client wrapped up their http-to-https migration and signed off. Three weeks later the blog template still hardcodes an http:// analytics script into every post, blocked in modern browsers, and nobody caught it. Put the check on a blog post URL and Hoppla flags it on the first scan and names the offending script. You fix one template instead of clicking through the whole site by hand.
You run https across hundreds of client sites, and 'we're fully secure' is a claim someone eventually has to back. Add the mixed-content check to the monitors you already operate. Then when a CMS update hardcodes an http:// embed on one client's homepage, it surfaces as a warning on that monitor's timeline, with no one-off crawl per domain to commission and no estate-wide audit to schedule.
You sell https hosting under your own brand, and a broken padlock on a customer's site reflects on you, not them. The scan runs on the monitors you add it to, white-labeled, with the warning arriving under your brand name and alert prefix. So when a customer pastes an http:// image into a monitored page, you see it on the next scan. The message becomes 'we spotted an insecure asset on your site' instead of a confused support ticket landing in your queue.
Import your Oh Dear monitors into Hoppla. Then run both side by side for 24 hours or 7 days before you switch.
The importer opens in your workspace once you have access.
Get early accessYou don't switch one check, you consolidate. In Oh Dear, mixed content is its own thing to configure and pay for. In Hoppla it's one more check on the monitor you already have for uptime, SSL, and DNS: one timeline, one bill, one switch.
No. Mixed content is advisory: it resolves to a warning and never fires a downtime incident, because a page with an http:// asset still loads. It shows up on the monitor's timeline as something to fix, not an outage to wake up for.
Mixed content is, by definition, insecure resources on a secure page. An http page has no padlock to break, so there's nothing to flag. Hoppla checks the scheme first and only scans when the page is served over https.
Hoppla lists the first 100 offending resources by URL and reports the total count. When the total is higher than the list, it's often one templated asset repeated across the markup. Fix the source once and the whole count can clear.
Checks, alerts and status pages in one workspace. Now in early access: join the list for an invite.