Help Centre
Welcome to the Httpfind Help Centre. This page covers everything you need to get started, the most common questions about mixed content scanning, known platform limitations, and how to reach us when something goes wrong.
Getting started
Httpfind is a diagnostic tool that tells you exactly which http:// subresource
is breaking your HTTPS padlock. It works server-side — you paste a URL, we fetch the page,
and we list every resource loaded over plain HTTP, grouped by how your browser treats it.
- 1. Go to the Scan page.
-
2. Paste a full HTTPS URL (including
https://) into the input. - 3. Click Scan. Results appear below within a few seconds.
- 4. Review the summary — total mixed content resources, broken down by blocked (scripts, stylesheets) and upgraded-or-warned (images, media).
- 5. Each resource shows the full offending URL and the line number where it appears in the page source.
No account needed. No data is stored on our servers (see Privacy Policy).
Frequently asked questions
A valid certificate and a green padlock are two different things. The certificate confirms the connection to your server is encrypted. The padlock requires that every resource on the page — scripts, stylesheets, images, fonts, iframes — also loads over HTTPS. If even one resource is loaded over plain HTTP, the browser shows a "not fully secure" indicator (a grey padlock with a slash, or the text "Not secure").
This is called mixed content. Httpfind finds the exact URL and line number of that one offending resource so you can fix it.
Open the Scan page, paste a full HTTPS URL into the text input
(for example: https://www.wikipedia.org/wiki/Mixed_content), and click
Scan. The tool fetches the page server-side, parses the HTML for
http:// subresource requests, and returns a line-numbered list.
Results are grouped into a summary bar (total / blocked / warned) and an itemised resource list with the type tag (script, link, img, iframe, font, etc.), the full URL, and the line number. Past scans are stored in your browser's localStorage for quick recall.
Httpfind classifies mixed content resources into two categories that mirror how your browser handles them:
-
Blocked — scripts (
<script>) and stylesheets (<link rel="stylesheet">). Modern browsers refuse to load these over HTTP when the page is served over HTTPS. They simply do not execute. - Upgraded-or-warned — images, media, iframes, fonts, and other non-executable content. Browsers may silently upgrade these to HTTPS (if the resource supports it) or load them with a downgraded security indicator. The padlock is still broken even if they load.
Either category will cause the browser to show a "not fully secure" indicator. Fixing both is required for the full green padlock.
Httpfind runs on Cloudflare Workers. When you scan a URL, a Cloudflare Worker fetches the page. Cloudflare's platform will not open a connection back into its own network, so any domain that is itself behind Cloudflare appears unreachable:
- example.com (Cloudflare proxied)
- stackoverflow.com (Cloudflare proxied)
- cloudflare.com, 1.1.1.1
Httpfind can scan hosts that are not on Cloudflare, such as wikipedia.org, github.com, and self-hosted servers. If your site is on Cloudflare, the only workaround is to run a local scanner or check your page manually in a browser's developer tools (Network tab).
No. The URL you submit is sent to our API to fetch the page and generate the scan results. It is not logged, stored, or associated with any identifier. After the scan completes, the result is sent back to your browser and the URL is discarded server-side.
Scan history is stored only in your browser's localStorage on the app page. This data never reaches our servers. You can clear it at any time by clicking the "Clear history" button in the sidebar or clearing your browser's site data. See the Privacy Policy for full details.
The Free tier allows up to 5 scans per day. No account or registration is required.
The Pro plan ($7 / month) adds unlimited scans, CSV / JSON export (when built), and priority support (when a support channel is established).
Important: No payment processor is currently connected. The checkout on the pricing page is a demonstration only. No real payment is taken, no account is created, and no subscription is started. Pro features cannot be purchased until a payment provider is added.
Known limitations
Httpfind is a young tool. The following limitations and missing features are known and tracked:
| Feature / Area | Status |
|---|---|
| Scanning Cloudflare-proxied hosts | Not supported. The platform (Cloudflare Workers) cannot open connections back into Cloudflare's network. This is a platform limitation, not a bug. See FAQ above. |
| Export (CSV / JSON) | Not yet built. Buttons on the scan page are disabled and labelled "coming soon." No timeline is set. |
| Payment processor | Not connected. The Pro subscription checkout on the pricing page is a demo only. No real payment can be made. |
| User accounts | Not implemented. There is no sign-up, login, or account dashboard. Scan history is browser-local only and does not sync across devices. |
| Email sender | Not connected. Httpfind cannot send email, alerts, receipts, or notifications of any kind. |
| Scanning pages >10 MB | Not supported. The Cloudflare Workers platform imposes a response size limit. Larger pages will fail. |
| Subresource integrity (SRI) check | Not supported. Httpfind reports the URL and type but does not verify integrity hashes. |
| Legal entity / jurisdiction | Not established. Httpfind is operated by an individual who has not registered a company. See the Terms of Service for details. |
| API / programmatic access | Not available. There is no public API endpoint for automated scanning beyond what the web app uses. |
Contact us
No email address or contact form is available at this time. The operator of Httpfind does not yet maintain a mailbox or communications channel.
If you have found a bug, have a feature request, or need help beyond what this Help Centre covers, your best option is to record your request with the owner directly. Once a support channel is established — email, form, or a public issue tracker — this page will be updated with the details.
In the meantime, the scan page and the pricing page describe the current state of every feature. No sync across devices, no export, no email — these are all known gaps rather than surprises.
How the scan works (technical)
When you submit a URL, a Cloudflare Worker fetches the page server-side and parses
the returned HTML for tags that request subresources over HTTP: <script
src="http://...">, <link rel="stylesheet"
href="http://...">, <img src="http://...">,
<iframe src="http://...">, and several more. It also scans inline
event handlers and CSS url() references where possible.
The scan reflects what the server returned at the time of the request. Dynamic pages that inject content via JavaScript after load will not have those resources visible to a server-side fetch — the tool does not execute JavaScript.
For a complete picture, combine Httpfind's server-side scan with a manual check in
your browser's Developer Tools → Network tab, filtered by http://
requests.