Mixed Content Detector

WHAT IT DOES

Mixed Content Detector scans the current page for mixed content—HTTP resources loaded on an HTTPS page. It checks every resource type: images (including srcset and background images), scripts, stylesheets, fonts (from @font-face), iframes, video, audio, and XMLHttpRequest/Fetch requests. Each insecure resource is displayed with its URL, category, and a specific recommendation for fixing it (e.g., replace "http://" with "https://" or use protocol-relative URLs). Filter by resource category to focus on specific types (images, scripts, stylesheets, fonts, iframes, media, or XHR). Copy the list of insecure URLs to your clipboard for documentation or batch fixing. Perfect for security audits, maintaining HTTPS compliance, and preventing browser security warnings.

WHERE IT RUNS

Any HTTPS webpage—the script scans the DOM and resource requests. No server-side calls, no external dependencies, no site-specific configuration. Works on local development sites (localhost with HTTPS), staging environments, and production sites. The tool automatically detects mixed content from both static HTML elements and dynamically loaded resources.

HOW TO USE

Install the script and open any HTTPS page. The panel automatically scans and displays all mixed content resources found. Toggle specific resource categories (Images, Scripts, Styles, Fonts, Iframes, Media, XHR) to filter the results. Each insecure resource shows its URL and a recommended fix. Click "Scan Now" to re-scan—useful for pages with dynamic content loads. Click "Copy URLs" to copy the entire list of insecure resources to your clipboard. Keyboard shortcut: Ctrl+Shift+M to re-scan without opening the panel.

TECHNICAL MECHANISM

The script scans the page using a comprehensive multi-method approach. For static elements, it queries the DOM using selectors for each resource type: img (src and srcset), script[src], link[rel="stylesheet"], iframe, video, audio. For fonts, it iterates over document.styleSheets, extracts CSSRule.FONT_FACE_RULE rules, and parses the src property for url() values. For background images, it checks the computed style of all elements using window.getComputedStyle(el).backgroundImage. For XHR/Fetch requests, it reads performance.getEntriesByType('resource') entries with initiatorType 'xmlhttprequest' or 'fetch'. Each URL is resolved to an absolute URL and checked for the 'http:' protocol (relative URLs and protocol-relative URLs are resolved and evaluated). Results are deduplicated by URL and type, categorized, and rendered with color-coded severity. Recommendations are generated based on the resource type and URL pattern.

THE PANEL

The tool runs inside BGPanel, a lightweight UI system built into the BotGentz extension. Drag the panel by its header to reposition it anywhere on screen—it snaps to edges and remembers its position per site. Click the header to collapse the panel into a small bubble; click again to expand. Resize the panel by dragging its bottom-right corner. Press Escape at any time to close the panel. The panel stays out of your way but is always accessible via the extension's toolbar.

PLEASE NOTE

Requires the free BotGentz browser extension to run—this script does not work standalone. The script reads only the page's DOM and performance entries—it does not send data anywhere, does not store page content, and does not access other tabs or browser history. The tool only scans resources already loaded by the page; it does not make network requests to verify resources. Performance API entries may not capture all network requests in all browsers. The script only detects mixed content on HTTPS pages—HTTP pages are not scanned since mixed content is not applicable. Resources loaded via JavaScript after page load may require a manual re-scan. Sites change over time, but this script relies on standard DOM and Performance APIs, not site-specific selectors, so it remains robust across most pages.