The certificate is valid. Find the one http:// breaking your padlock.
Enter an HTTPS URL. Httpfind fetches the page server-side and lists every subresource loaded over plain HTTP — scripts, stylesheets, images, iframes — classified by how your browser treats each one. One offending URL is all it takes to lose the padlock.
Scan results
What Httpfind does
Scans your page server-side for every http:// resource request
Classifies each resource as blocked (scripts, stylesheets — browsers refuse these outright) or upgraded-or-warned (images, media — browsers may allow but downgrade the security indicator)
Reports the exact line number and full URL so you can find and fix it
Detects mixed content even when the upstream page returns a non-2xx status
No sign-up required — scan any public HTTPS URL immediately
Platform note: Httpfind runs on Cloudflare Workers. It can scan hosts like
wikipedia.org, github.com, and news.ycombinator.com. It cannot reach hosts that
are themselves behind Cloudflare (example.com, cloudflare.com, 1.1.1.1, stackoverflow.com) — those
will report as unreachable rather than as a scan result, because the platform will not open a
connection back into its own network. If your site is on Cloudflare, the scan will not work from
this tool.
Ready to diagnose your site?
Enter a URL above, or visit the dedicated scan page for a full forensic view.