How to use the Webpage Mixed Content Finder.
An insecure resource reference is a finding to inspect in context. Browser handling differs by resource type and policy, so do not equate every reference with an exploitable vulnerability.
Make the workflow fit your task.
Identify insecure resource URLs referenced by an HTTPS page and classify their type and location. Distinguish a source reference from an observed network request or browser block. Verify an HTTPS replacement actually exists before recommending a URL change.
- What you provide
- HTTPS page resource URLs.
- What you get
- Insecure resource references visible in accessible page data.
See the input and the result.
Illustrative input and output · a teaching example, not a live WebAct run
Example input
HTTPS source page https://example.com/ contains <script src="http://assets.example.com/app.js"></script>. No network or console observations supplied.
Completed example
Resource: http://assets.example.com/app.js Type: script loaded into an HTTPS page. Finding: insecure script reference requiring mixed-content review. Observed browser outcome: not supplied. Next check: inspect the console/request and verify a supported HTTPS asset URL before changing the reference.
Load this input into the prompt, then copy it to WebAct to try the task. Your result may differ from the illustration.
Decisions and troubleshooting.
Should every http link on an HTTPS page be classified as mixed content?
Ordinary navigation links differ from resources loaded into the page. Classify the reference according to how the browser uses it.
Why does replacing http with https still break the asset?
The destination may not serve that resource over HTTPS. Test the supported endpoint and certificate rather than assuming a scheme change is enough.
Try it with your own source.
Replace the example with your material in the task prompt. Keep the requirements you need, then copy the task into WebAct.
Customize and copy the task ↑