MIXED-CONTENT DIAGNOSTIC TOOL

Certificate valid. Padlock missing. Find the one `http://` that broke it.

The certificate is fine. The TLS handshake succeeded. Yet the browser shows "Not Secure" — because one subresource on your page is loaded over plain HTTP. Paste your URL and Padfind names the exact resource, the line it appears on, and what the browser will do with it.

Enter a URL and click Check to see sample results below.

Padfind findings list showing two blocked resources (jQuery script, web font) and one warned resource (image), each with its URL, source line number, and a coloured classification chip.

01 / WHAT IT CHECKS

Every subresource. On every line. Named exactly.

Padfind fetches your HTTPS page, parses every element that can load an external subresource, and returns a structured list. Every <script>, <img>, <iframe>, stylesheet, @font-face, and embed is found — by the exact attribute it uses, the line it appears on, and whether the browser will block the resource or just downgrade the security indicator.

Scans every resource-loading element: scripts, stylesheets, iframes, images, fonts, embeds

Parses inline <style> blocks and external stylesheets for @font-face and url() references

Follows up to 5 redirects, validating each hop for safety

Rejects internal, loopback, and private-range targets

02 / BLOCKED VS WARNED

Not all mixed content is treated the same.

Browsers draw a sharp line. Resources that can execute code or affect the page layout (<script>, stylesheets, <iframe>) are blocked outright — the browser refuses to load them on an HTTPS page. Images, video, audio, and prefetch hints may be silently upgraded or downgrade the security indicator without blocking content. Padfind tells you which class every resource falls into.

Blocked

Blocked — These resources are never loaded. The padlock never appears.

<script src="http://...">
<link rel="stylesheet" href="http://...">
<link rel="preload" href="http://...">
<iframe src="http://...">
<object data="http://...">
<embed src="http://...">
@font-face url(http://...)

Upgraded or Warned

Warned — May load but degrade the indicator.

<img src="http://...">
<video src="http://...">
<audio src="http://...">
<source src="http://...">
<link rel="prefetch" href="http://...">
<link rel="preconnect" href="http://...">

03 / WHAT IT COSTS

Free. No account. No tier lockout.

Every feature of Padfind is available for free. There is no rate limit, no "pro" feature hidden behind a paywall, and no account to create. The pricing page describes a paid plan for future team/scheduled scanning features still in development — the tool you see today costs nothing and will keep working as-is.

$0 Free forever — full feature set. See pricing details →

04 / WHAT IT WILL NOT DO

Four limits you should know before you run a check.

No JavaScript execution

Padfind reads the raw HTML your server sends. It does not run JavaScript. If your page loads subresources dynamically (after the initial render), those resources will be missed. This is a platform limitation — a headless browser would be needed, and the Worker runtime cannot run one. Single-page apps that fetch bundles via JS after load are the most common blind spot.

External stylesheets may be unreachable

If a stylesheet host is down or refuses the connection, Padfind skips it. HTML-based findings are still reported; CSS findings for that host are silently omitted.

Hosts behind Cloudflare appear unreachable

The Worker runtime cannot open a subrequest to a host that is itself behind Cloudflare. Those hosts will be reported as unreachable rather than as closed. This affects a large share of the web; if your check says the host is down, verify from another network first.

Error-page findings may mislead

If the target page returns a 4xx or 5xx status, findings are based on the error page body — not the real page content. Padfind warns you when this happens.

05 / WHAT A RESULT LOOKS LIKE

A findings list. Every row is a single actionable item.

No dashboard. No charts. One column of findings, each with the exact URL, its source line in the page, and a classification chip that tells you what the browser will do.

Blocked: 2 Warned: 1 Total: 3

Blocked http://cdn.example.com/legacy/jquery.js Line 47 <script>

Blocked http://fonts.example.com/old-font.woff Line 32 @font-face

Warned http://media.example.com/banner.jpg Line 84 <img>

No issues When every resource uses HTTPS, Padfind returns an empty list with a green indicator.

06 / A SCEPTIC ASKS

“My certificate is valid. I checked with three tools. Why would Padfind help?”

A valid certificate and a missing padlock are two different problems reported by the same browser UI. The certificate establishes a secure tunnel to your server. The padlock means every resource the page loads also uses that tunnel. One hardcoded http:// in a template you have not touched in three years — or a third-party embed the marketing team added last week — pulls the padlock away, and no certificate tool will find it because the certificate is not the problem. Padfind finds the resource.

“The page loads fine in my browser. Why would the padlock be missing?” +

Your browser still loads the content (images, video, audio loaded over HTTP may still display), but it removes the padlock indicator. Scripts and stylesheets over HTTP are blocked entirely, which may cause visual breakage you do not notice on a cached page. The padlock is a policy signal, not a connectivity signal.

“Chrome says ‘Not Secure’ but does not tell me which resource.” +

The DevTools console lists blocked subresources, but it is a long, uncategorised list mixed with every other browser message. Padfind gives you just the mixed-content findings, grouped by classification, with the exact source line — no log noise.

“I use a CSP header. Doesn’t that handle mixed content?” +

A Content-Security-Policy header with upgrade-insecure-requests can tell the browser to upgrade HTTP resources to HTTPS — but it only works if the HTTPS version of the resource exists. If the HTTPS URL 404s or the host does not serve HTTPS at all, the resource still fails and the padlock is still affected. Padfind tells you what the page actually requests, which is what matters.

Certificate valid. Padlock missing. Find the one http:// that broke it.