HELP CENTRE
How to use Padfind — and what to do when something is wrong.
Everything you need to run a check, understand the results, and fix the mixed content your page is serving. If you still have questions, we are here.
01 / GETTING STARTED
Three steps to find your missing padlock.
- Open the checker. Go to the App page. You will see a single text field and a Check button. No account, no login.
-
Paste an HTTPS URL. Paste the full URL of the page you maintain. It must
start with
https://— Padfind does not check plain HTTP pages (they do not have a padlock to lose). Make sure you are on a page you own or are authorised to test. - Click Check. Padfind fetches the page, parses every element that can load a subresource, and returns a findings table. Each row shows the classification (Blocked or Warned), the exact URL, the source line, and the element type.
That is all. If the table is empty, every resource on your page loads over HTTPS — your padlock is not broken by mixed content. If findings appear, each one is a resource you need to update.
02 / COMMON QUESTIONS
Your most likely questions, answered.
These are two different reports from the same browser UI. The certificate establishes
a secure tunnel between your server and the browser. The padlock means every resource
the page loads also uses that tunnel. One hardcoded http:// in a template
or a third-party embed pulls the padlock away, and no certificate checker will find it
because the certificate is valid. That is exactly the gap Padfind fills.
Browsers draw a hard line based on how dangerous the resource type is:
- Blocked — Scripts, stylesheets, iframes, fonts, and other resources that can execute code or change layout. The browser refuses to load these on an HTTPS page. Your padlock never appears and parts of your page may be missing.
- Warned — Images, video, audio, and prefetch hints. The browser may load these (displaying broken images or playing the audio), but the security indicator is downgraded to "Not Secure" or a grey padlock.
The resource may be injected by a server-side process you do not edit directly:
- CMS plugins / widgets — Many content-management systems load
third-party embeds (analytics, fonts, social widgets) via hardcoded
http://in plugin code. - CDN or reverse-proxy rewrites — A CDN may rewrite resource URLs in transit; an older cache entry may still reference HTTP URLs.
- Templating engines — Server-side includes or partials
(e.g.,
{% include "analytics-head.html" %}) may come from a shared library that has not been updated. - Server-generated inline styles — Some platforms generate
<style>blocks withurl(http://...)based on legacy database values.
Search your entire codebase for the reported URL string. If it is not there, check your CMS plugin list, CDN configuration, and any server-side includes.
No. Padfind runs on Cloudflare Workers and fetches the page from the public internet.
It cannot authenticate, follow session cookies, or reach private networks. If you need
to check a page behind a login, you must make it temporarily accessible (e.g. via a
staging URL with IP whitelisting that includes Cloudflare's proxy ranges) or use a
local tool like curl with the --insecure flag on a local
HTTPS dump.
Each reported URL just needs http:// changed to https://.
The practical steps depend on where the URL lives:
- In your own templates — Edit the hardcoded URL, or use a
protocol-relative URL (
//cdn.example.com/file.js) if the host supports both schemes. - In a CMS — Update the plugin or widget settings. Some CMS platforms have a "site URL" setting that should be set to HTTPS.
- From a third-party embed — Check whether the third party
serves HTTPS. Most do. Replace the
http://embed URL with thehttps://variant — it is often the same path. - If the host does not support HTTPS — You need to find an alternative provider or self-host the resource so you can serve it over HTTPS yourself.
After making changes, run another Padfind check to confirm the finding no longer appears.
No and no. Padfind has no user accounts, no login, and no server-side storage. Each check is stateless: the URL is sent to the API, the Worker fetches the page, parses it, and returns the findings as JSON — nothing is logged or retained. There is no rate limit, no tier, no pricing for the current product. For full details, see the Privacy Policy.
03 / KNOWN LIMITATIONS
What Padfind cannot do — and what is still under development.
These are genuine constraints of the current product. We document them so you do not waste time on a check that cannot work for your use case.
No JavaScript execution
Padfind reads the raw HTML your server sends. It does not execute JavaScript. If your page loads subresources dynamically (after the initial render), those resources are missed. Single-page apps that fetch bundles via JS after load are the most common blind spot. A headless browser would be needed, and the Worker runtime cannot run one.
No paginated, logged-in, or private-network pages
Padfind fetches one URL from the public internet. It cannot handle forms, authentication, multi-page flows, or hosts on private subnets (localhost, 10.x.x.x, 192.168.x.x, etc.).
CSS parsing is regex-based
External stylesheets are parsed with regular expressions, not a full CSS parser. Edge cases in minified or unusually formatted CSS may produce incomplete findings. If a stylesheet host is unreachable, its findings are silently omitted.
Cloudflare-hosted pages appear unreachable
The Worker runtime cannot open a subrequest to a host that is itself on Cloudflare's network. Those pages will be reported as unreachable. If your check says a host is down, verify from another network first.
No scheduled scanning (in development)
Padfind currently checks one URL at a time, on demand. Scheduled recurring scans, team dashboards, and API access are planned for a future paid tier and are not yet available.
No email alerts (platform limitation)
Padfind has no email sender and cannot send notifications. Any feature described elsewhere as providing email alerts is not yet functional. This is a platform constraint — no email infrastructure is connected.
04 / GET IN TOUCH
Still stuck? We will help you find the answer.
If the information above does not cover your situation, send us an email. We reply within three business days.
Email padfind@agen2ic.ai with your question. Including the word “Padfind” in the subject line helps us route your message to the right person faster. agen2ic.ai accepts mail at any local part, so your message will reach a human.
padfind@agen2ic.aiResponse time: within 3 business days. For billing and subscription questions, also use this address.