67

What's the most efficient way to find a list of all non-HTTPS URLs requested by an HTTPS page? If this kind of security violation happens, every browser alerts the user, but I can't find an easy way to find what exact URLs cause the violation.

The easiest way I've found so far is to use Firefox, but even then it's still not very convenient. First, I can right-click, select View Page Info, click the Media tab, and scroll through a list of URLs. However, this seems to only list image files, not CSS or JS includes that can also cause the error. For those, I have to use the Firebug extension, select the Net tab, and manually hover my mouse over each item to see the entire URL. Unfortunately, this can take a while if you have dozens of media files. Is there a better way?

Improve this question
2
  • You might look into the TamperData plugin for Firefox.
    – Pointy
    Commented Jan 18, 2011 at 20:11
  • I know this is an old post but maybe this will help someone, there's a Desktop app you can use to scan and report on mixed content issues on an entire site: ecommerce.co.uk/httpschecker. You can also request scan results through email too :)
    – stilliard
    Commented Apr 3, 2016 at 10:14

12 Answers 12

Reset to default
99

Note, in recent versions of Chrome, these errors will be displayed in the Javascript Console.

e.g.

The page at https://mysecuresite.com displayed insecure content from http://unsecuresite.com/some.jpg.
Improve this answer
5
  • 7
    On Firefox, HTTP requests sent from a HTTPS connection can be seen in red on the Web Console (Tools>Web Developer>Web Console or Ctrl+Shift+K).
    – AxeEffect
    Commented Dec 7, 2012 at 15:51
  • 2
    If using Chrome or Firefox consoles you still don't see the HTTP insecure request you will have to use Fiddler or WhyNoPadlock.com as suggested below.
    – AxeEffect
    Commented Dec 7, 2012 at 15:59
  • Watch out for browser plugins causing the problem
    – Matt Watson
    Commented May 24, 2014 at 12:41
  • I found Chrome much more reliable than anything else for this. It was the only way I could track down a resource loaded quite far down a chain of loaded JS resources. Firefox and two online checkers (SSLcheck and Why No Padlock) couldn't identify it, although Firefox did complain it was there and block that particular content, it just wasn't reporting it in the console.
    – user2493235
    Commented Jun 4, 2016 at 15:55
  • Even firefox has it under the console. The point is, it's available in browser's console.
    – pankaj
    Commented Aug 26, 2019 at 11:24
32

Try: www.WhyNoPadlock.com It will give you a report of all insecure content on any https web page.

Improve this answer
3
  • 5
    Doesn't help for content that requires authentication
    – Obie
    Commented Mar 21, 2012 at 21:28
  • 2
    I like @Rob's answer better. The site he shared tells you exactly which items are insecure. My issue was that Google fonts was being requested without https and the site saved me a lot of time going through my files so check for https in all my includes.
    – pmalbu
    Commented Aug 20, 2014 at 18:01
  • The tool said that no insecure content found while a tool shared by another user below (SslCheck) says there are six pages with insecure links (which are real culprit).
    – Alam
    Commented Oct 4, 2017 at 10:35
12

You can use SslCheck

It's a free online tool that crawls a website recursively (following all internal links) and scans for unsecure content - images, scripts and CSS.

(disclaimer: I'm one of the developers)

Improve this answer
7
  • 1
    While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes.
    – Raedwald
    Commented Aug 20, 2014 at 22:44
  • 4
    @Raedwald It's an online tool. How do you include the essential parts of that here?
    – Mike
    Commented Aug 20, 2014 at 23:12
  • 2
    Nice tool, but it's not checking <form> elements. In my case, a site was implementing their search with <form method="get" action="http://www.google.com/search"> which triggered the Chrome warning.
    – Abe Voelker
    Commented Oct 24, 2014 at 14:58
  • 1
    @AbeVoelker Thanks, I'll contact the team to update it.
    – Alex from Jitbit
    Commented Oct 24, 2014 at 15:08
  • 1
    Thank you for sharing this great tool, I found it via Google but came here to see whether it works properly or not.
    – Alam
    Commented Oct 4, 2017 at 10:36
11

I recently had the same issue. Using Chrome's Developer Tools, it was easier to find. In Developer Tools, go to the Security tab. There you can find all non-HTTPS requests.

Screenshot of the Developer Tools 'Security' tab

Improve this answer
6

I had this problem which occurred in a javascript:

/* for Internet Explorer */
/*@cc_on @*/
/*@if (@_win32)
    document.write("<script id=__ie_onload defer src=javascript:void(0)><\/script>");
(.....)

The src=javascript:void(0) should be avoided.

You can not find this problem using Fiddler or Chrome.

Improve this answer
5

Use Fiddler.

Secure requests won't show up at all (except as HTTPS CONNECTs, which can be hidden), so everything you'll see is bad.

Improve this answer
3
  • Alas, I'm on Linux and it says it requires Windows. Does it work at all under Mono?
    – Cerin
    Commented Jan 18, 2011 at 20:14
  • 1
    I would guess not, but I don't know.
    – SLaks
    Commented Jan 18, 2011 at 20:16
  • Not necessarily @Obie , I am using it over Ubuntu using Mono, an open source implementation of Microsoft's .NET that is really easy to install and use.
    – Juan Antonio
    Commented Nov 20, 2018 at 10:05
3

You can check https://www.missingpadlock.com/

Is a online tool for crawl your site for find insecure pages.

Improve this answer
2

If you own the website, you should look into the Content-Security-Policy header options. These can include forcing HTTPS on resources, or automatically attempting to redirect HTTP resources to HTTPS, among other things.

Notably, there is also a report-uri directive for the closely-related Content-Security-Policy-Report-Only header that reports any infractions of your CSP to a uri of your choosing. This means that any browser with support1 for report-uri will send you reports of pages on your site with problematic HTTPS on an ongoing basis. Mozilla Developer Network has a PHP example of handling the reports.

1 Note that if you can reasonably expect any browser with full CSP(RO) support to hit the pages in question, it doesn't matter that some browsers do not have support for it.

Improve this answer
1
  • 1
    This is something it's good to be doing on an ongoing basis anyway. If you can't handle the reporting end conveniently yourself, a service like report-uri.com can be used.
    – dartacus
    Commented May 15, 2018 at 13:34
1

I just want to leave a note about what happened to me when this problem arose.

Suddenly my domain showed 'Mixed: Insecure Items'. I couldn't find the cause at all. The console was just showing an image was being requested: http://www.example.com/, Which I could not find any reference to anywhere.

I searched and searched and eventually found that in the Security Tab of Chrome, Where it was displaying 'Insecure Content' it said 'Show in Network Tab'. When I clicked that, It was showing me the bad URL, again, with no information apart from the Initiatior column. It was showing the image footer_bg.jpg.

Had someone injected code into my footer background image I wondered? Turns out no, I had inadvertently moved that image yesterday and forgot about it. So the page was requesting an image that wasn't there, returning an error. I fixed the link to the image and page loads securely again.

Just for anyone else that will possibly have this problem in the future.

Improve this answer
1

If you want a one-shot, reasonably-comprehensive, recursive scan of an entire website, you can use Bramus's mixed-content-scan from the CLI. It won't check links in supplemental JS/CSS, but it's great for finding that one post that the intern from 3 years ago put up with a dangerous non-SSL script.

For an ongoing solution, see my other answer.

Improve this answer
0

Use Burp Suite, set up the scope as your website, browse to the secure page and check which request are made to HTTP version of your website.

Improve this answer
0

We encountered this on an internal site. None of the URLs used in the assets were with HTTP but the problem was that we used an incorrect URL (also with HTTPs) in script tag and that led MSEdge to use a fallback to use HTTP scheme, since the HTTPs URL couldn't be reached. Fixing the incorrect URL was the solution for us.

Improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.