Mixed content checker

The scanner reads the HTML exactly as the server delivered it, so resources injected by client-side JavaScript after load are out of scope, and it never executes the page's code. Before scanning it strips HTML comments and script and style element bodies, so their text is not misread as tags. It checks src, href, srcset, and poster attributes plus style attributes for plain-http references, and classifies them the way browsers do: scripts, stylesheets, frames, and objects are blockable, images, video, and audio are passive. Protocol-relative references, the ones that start with two slashes, are listed separately, since on an HTTPS page they load over HTTPS and only break if the page is ever served over HTTP. The proxy hands back at most the first 4,096 characters of the response, so a larger page is scanned on that prefix and the report says so. It does not fetch stylesheets or follow CSS imports, so http references inside CSS files are not counted.