how to track down "this page contains both secure and nonsecure items"

Question

As far as I can tell, there are no unsecure items --- when I browse to the site with IE7 or FireFox 3 I don't get any such warning, but if I hit the site with IE6 I get the security informaiton dialog box "This page contains both secure and nonsecure items Do you want to display te nonsecure items?"

How can I track down the cause of that message?

Answer 1

Use Fiddler, after clearing your cache. It'll show everything that your web browser fetches from the remote site. Look for anything that's not https.

Answer 2

As it turns out it has nothing to do with nonsecure traffic per se, but with a hack that one of the HTML boys did --- they have an empty iframe (without a source) that they place on the page, so they can then do some placed content on top of that --- gut the iframe out of the code and the warning dialog box went away. IE7/8 and FF doesn't do it.

AFter adding a blank.gif we're able to https to that gif (what a pain) and now it's all good.