When I visit our web site pages with IE over HTTPS, it reports the web site as protected (i.e. no elements are taken using HTTP). The same page, when loaded to Firefox, causes Firefox to complain that some elements are non-secure. I checked the source code of the page and the list of resources of the page (Firefox displays the list of resources) - there are no http resources, only HTTPS ones are listed.

The question is - how do I diagnose, what resources (images or CSS or JavaScript) are loaded using HTTP and not HTTPS? I assume that some plugin is needed. Firebug doesn't have anything helpful, as it seems.


The mystery has been discovered. Under certain [rare] combination of conditions Facebook instead of providing a PNG image of the page statistics (embedded into the page) reports the error (some HTML via Javascript). As the original resource is a PNG, Firefox simply doesn't display that PNG, but seems to execute the javascript code, sent by Facebook. Obviously, this JavaScript could not be easily tracked as it was not being displayed or even mentioned anywhere (except maybe deep in the DOM inspector). Changing the conditions eliminated the erroneous javascript. However, the question regarding the tool that would help discover such "hidden" code and other resources remains actual.

  • @Lime at the moment the answer is not found. The question was about a tool to find such issues. Commented Apr 30, 2011 at 5:17

4 Answers 4


Grab the add-on Httpfox.

After the installation, restart the browser and you'll have a new icon in your status bar. Right-click it and choose "Open in a new window". In that way, you can maximize the window and get a faster overview of all URL's. Press Start and reload your page.

Alternatively, use the Web developer toolbar to get a list of all images, CSS and Javascript files.


Just view the source code and look for anything that is loaded with http:// and not https://. Any basic text editor can do this quickly for you. Be sure to check

  • JavaScripts
  • Stylesheets
  • Images
  • Objects
  • Frames


  • Scripts and widgets from other sites like Facebook
  • Favicon

Make sure you manually check as Firefox may not be reporting all resources on the page. Just media.

  • Please re-read the question. I explicitly mentioned, that I have checked the source code. If it was that simple, I wouldn't waste anyone's time by posting the question. Commented Apr 29, 2011 at 13:26

You could try http://www.webpagetest.org/

Run your https URL through the site, then click on the 'waterfall view'. All resources loaded over https will display a padlock icon. Those loaded over http won't. Here's what the output for https://twitter.com looks like, for example:

Testing for https resources with webpagetest.org

  • Thank you for a tip. This site appears to be generally very useful tool and it would solve the problem (with one minor exception - in my rare combination of factors firefox and my cookies played the key role). So I am still looking for firefox add-in if one exists. Commented Apr 29, 2011 at 17:52
  • 1
    I don't know of a Firefox plugin, but 'Charles' is a nifty app for Windows, Mac, and Linux that lets you monitor traffic between your browser and the Web: charlesproxy.com It sounds like it would be handy for HTTPS debugging. There is also Fiddler (Windows only): fiddler2.com/fiddler2
    – Nick
    Commented May 7, 2011 at 17:23

Something like Fiddler should be able to catch all http related traffic between your browser and any web servers required to load a page.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.