What this tool does
An HTTPS page is supposed to guarantee that everything the browser loads is encrypted and verified along the way. Mixed content breaks that guarantee: an image, script, or stylesheet loaded over a plain http:// URL on an otherwise secure page. This tool fetches the page you point it at, confirms it's actually served over HTTPS, then scans its HTML for exactly these unsecured resources.
Why it's almost always an accident
Mixed content is almost never a deliberate choice — it's leftover debris from an incomplete HTTP-to-HTTPS migration: text hardcoded into a CMS with an http:// URL from before the migration, a third-party widget whose embed code was never updated, or an image sitting on an old subdomain that never got its own SSL certificate. The site still looks fine, which is exactly why it usually goes unnoticed until someone opens the browser dev console — or runs a tool like this one.
Active content vs. passive content
Browsers treat mixed content differently depending on what it's capable of doing. An HTTP script or iframe can actively change how the page behaves, so browsers typically block it outright without even loading it, which tends to break something visibly. An HTTP image or stylesheet can't execute code, so most browsers load it anyway and just show a discreet indicator in the address bar — which makes it far easier to miss, even though the underlying problem is the same.
The third-party resource problem
Third-party widgets and scripts — live chat, embedded maps, web fonts, analytics — are a common source of mixed content, because the copy-pasted embed snippet may predate that service offering HTTPS at all. The good news is that nearly every third-party service today supports HTTPS, and the fix is often as small as changing http:// to https:// in a single <script> or <link> tag, with the rest of the integration untouched.
What this tool doesn't catch
It only scans the initial HTML returned by the server — not resources added dynamically by JavaScript after the page loads, and not AJAX or fetch requests made over HTTP from an otherwise HTTPS-loaded script. For those cases, the browser's own dev console (the Security or Console tab) is still the right tool, since it watches the page as it actually runs rather than its raw HTML.