Credibility · 22 points
Mixed content
One check, stated three ways: what we measure, what would make it wrong, and how to confirm it yourself.
What this measures
On an HTTPS page, subresource references still written as http:// — src, srcset, poster, data-src, background and url(...) in inline style.
Where this check can be wrong
Browsers block some of these and quietly upgrade others, so a page with mixed content may already look fine. The count is also of attributes in the raw HTML, not of requests the browser actually makes.
Verify it without taking our word for it
Open the page and read DevTools → Console for “blocked mixed content” warnings; that is the browser's own answer.