What the mixed content checker scans
Mixed content is an HTTPS page that loads something over plain HTTP. The checker fetches your page, follows redirects, and lists every absolute http:// URL it finds in the src, href, action, formaction, poster, background and data-src attributes of the HTML.
It reads the HTML your server sends. Resources added later by JavaScript, URLs inside CSS files and srcset candidates are not covered, so a clean result means the markup is clean, not that the browser never makes an HTTP request.
Which findings matter
Scripts, stylesheets and iframes over HTTP are blocked by browsers, which usually breaks the page, and a form that submits to an http:// action shows a warning before sending. Images, audio and video are upgraded to HTTPS by Chrome and Firefox, and fail to load if the server has no HTTPS version.
Plain links (an a tag with an http:// href) are listed too, because they leave visitors on an unencrypted page, but browsers do not block them.
Frequently asked questions
How do I fix mixed content?
Change each http:// URL to https://, after checking the resource is served over HTTPS. For a large site, the Content-Security-Policy directive upgrade-insecure-requests makes browsers request every subresource over HTTPS while you clean up the markup.
Why does my padlock still show a warning after the scan is clean?
The request is probably made by JavaScript or from a CSS file, which this scan does not read. Open the browser console: it names every mixed content request it blocked or upgraded.
Is mixed content bad for SEO?
Indirectly. Google treats HTTPS as a ranking signal, and blocked scripts or stylesheets can break the page that is rendered and indexed.