How can you tell exactly what insecure items are causing a browser to warn about mixed secure and insecure items?

Solution 1:

I found that I get the "mixed content"-warning in Chrome even when there is no mixed content, if sometime during the session mixed content was already encountered on the domain.

(Also mentioned here: Why is Chrome reporting a secure / non secure warning when no other browsers aren't?)

Solution 2:

In Chrome's Developer Tools, the Console tab shows the resources that it won't load because they unsecure.

Solution 3:

You can add the "scheme" column to the Chrome developer tools network tab to show which requests were sent over http or https:

1. Press F12 to show the developer tools
2. Switch to the Network tab
3. Right click in the column headers and select "Scheme"
4. Reload the page to show which elements are loaded over http or https