Help Centre

This is the exact problem Httpfinder was built to solve. When a browser sees an HTTPS page that loads any subresource over plain http://, it must choose between two security models — and neither gives you the padlock.

Scripts and stylesheets are blocked outright by the browser. The page may look or behave differently than intended, but the threat (an attacker injecting code via the unencrypted resource) is neutralised. The padlock is still missing because the page was not fully secure.

Images, media, and fonts are typically still fetched but with a downgraded security indicator — the padlock is replaced with "Not Secure" or a warning icon, or the indicator disappears entirely (the "info" triangle in Chrome).

The certificate is not the problem. The problem is a mixed-content reference. Httpfinder finds that reference for you.

These are the two classes of mixed content as defined by browser security policies:

Blocked — scripts (<script src="http://...">), stylesheets (<link rel="stylesheet" href="http://...">), and other resources that could execute code or modify page layout. Browsers refuse to load these when the parent page is HTTPS. The resource line appears in your HTML but the browser never fetches it. Fix: change the URL scheme to https://.

Upgraded-or-warned — images, video, audio, fonts, and other media. Modern browsers (Chrome 86+) automatically upgrade these to HTTPS if the server supports it. If the server does not support HTTPS, the resource is fetched over HTTP anyway, but the browser shows a downgraded security indicator (no padlock). Fix: ensure the resource is available over HTTPS and update the URL.

The server that runs Httpfinder cannot connect to Cloudflare-fronted hosts (e.g. example.com, cloudflare.com, 1.1.1.1). This is a known infrastructure limitation — Cloudflare blocks the server's IP range.

If your site is behind Cloudflare, the scan will return an error for the page URL itself but may still detect http:// subresources from non-Cloudflare hosts. To work around this limitation, you can check the HTML source of your page manually for http:// references, or run the scan from a different network.

Httpfinder uses regex-based pattern matching on the initial HTML of the page. It does not execute JavaScript, follow redirects for the page itself, or parse CSS url() references. This means:

• Resources loaded dynamically by JavaScript (e.g. fetch(), new Image(), dynamically created <script> tags) are not detected.
• Background images and other url() references in CSS files are not parsed.
• Pages larger than 1 MB are truncated before parsing, so any subresources in the truncated portion are missed.

The tool is best understood as a first-pass diagnostic — it catches the common, easily-overlooked hard-coded http:// in HTML templates that causes the padlock to disappear. For comprehensive analysis, pair it with browser DevTools (Network tab, filter by mixed content).

No account is needed and the tool is free. Httpfinder is stateless by design — there are no user accounts, no logins, no API keys, no stored history. Paste an HTTPS URL, get the results, and that is the entire interaction.

A Pro tier with API access, higher limits, and batch scanning is described on the Pricing page for informational purposes but is not yet available for purchase. When it ships, accounts and billing will be introduced.

Pages exceeding 1 MB are truncated before parsing. The results include a note indicating that truncation occurred, and the list of detected mixed-content references may be incomplete. Subresources after the 1 MB boundary in the HTML will not appear.

There is currently no way to raise the limit on the Free tier. The planned Pro tier will offer a 5 MB limit for scanned pages.