Help Centre
Getting started, frequently asked questions, and what Srccheck can and cannot do today.
Getting started
Srccheck is a diagnostic tool that finds the exact URL breaking your HTTPS padlock. You do not need an account, and every scan is stateless — results exist only in your browser during the request.
Open the scanner page. No sign-up required.
Paste an HTTPS URL into the text field. The page must be served over HTTPS — mixed content is a problem that belongs exclusively to HTTPS pages.
Click Scan. Srccheck fetches the page, parses the HTML, and extracts every subresource URL from <script>, <link>, <img>, <iframe>, <video>, <audio>, <source>, and @font-face declarations.
Read the diagnosis. Results are grouped into two classifications: blocked (scripts and stylesheets — browsers refuse to load them entirely) and upgraded-or-warned (images, fonts, media, iframes — browsers may silently upgrade or show a downgraded security indicator). Each result includes the exact URL and the HTML fragment where it appeared.
Frequently asked questions
My certificate is valid — why is the padlock missing?
This is the exact problem Srccheck was built to diagnose. A valid certificate alone does not guarantee a full HTTPS padlock. If any subresource on your page (script, stylesheet, image, font, iframe) is loaded over plain http://, browsers downgrade the security indicator. Chrome shows "Not secure." Firefox shows a broken padlock.
Run the URL through Srccheck and it will list every http:// subresource on the page — the exact URLs and where in the HTML they appear. The fix is usually swapping http:// to https:// in the template or removing the embed.
Does Srccheck catch every mixed-content problem?
No. Srccheck parses the HTML as fetched from the server, so it detects static subresource references — <script src="...">, <link href="...">, <img src="...">, etc. It will not detect resources loaded:
- Via JavaScript after the page loads (DOM manipulation,
fetch(), dynamically created elements) - Via CSS
url()references outside@font-face(e.g., background images in stylesheets) - From third-party widgets that inject content after the initial HTML is parsed
- Over WebSocket connections (
ws://)
Results should always be verified independently — Srccheck is a diagnostic starting point, not a comprehensive security audit.
What do "blocked" and "upgraded-or-warned" mean?
Blocked (shown in red): Scripts (<script>) and stylesheets (<link rel="stylesheet">) loaded over HTTP are refused by every major browser. The page still loads, but the feature depending on that resource silently fails — analytics not reporting, styles not applying, forms broken.
Upgraded-or-warned (shown in amber): Images (<img>), fonts (@font-face), media (<video>, <audio>), and iframes (<iframe>) loaded over HTTP trigger a downgraded security indicator. Some browsers silently upgrade these to HTTPS when possible; others show the broken padlock but still load the resource.
Both categories need to be fixed for a full green padlock, but blocked resources will also break functionality immediately.
Is my scan data stored or shared?
No. Srccheck processes each scan in memory only. The URL you submit is sent to the scanner API, the target page is fetched and parsed, and the results are returned to your browser. No URL, scan result, or extracted content is logged, stored, or retained server-side. There are no accounts, no cookies, no tracking, and no analytics scripts on the site.
The scanner is hosted on Cloudflare Workers. Cloudflare processes requests in transit according to their own privacy policy, but no Cloudflare-specific cookies or tracking are set by this service.
See the full Privacy Policy for details.
How do I subscribe to Pro? Is it operational?
The Pro tier is not yet operational. The pricing page shows a demo checkout — no real payment is taken, no subscription is created, and no payment data is stored server-side. Batch scanning, export features, and priority scanning are in development and not available today.
The free Starter tier (scan any HTTPS URL, full classification, no account or rate limit) is fully functional and available now on the app page.
I submitted an HTTP URL and the scanner did nothing — why?
Srccheck only scans pages served over HTTPS. Mixed content is a problem that belongs exclusively to HTTPS pages — on an HTTP page there is no padlock to break. If you are seeing mixed-content warnings on an HTTP page, the page is already insecure by default and the browser will not show a padlock regardless of subresources.
Ensure the URL you paste starts with https://.
Does Srccheck check my certificate or security posture?
No. Srccheck does exactly one thing: it fetches your page and lists every subresource loaded over plain http://. It does not check SSL/TLS certificates, assess security posture, scan vulnerabilities, rewrite HTML, or judge whether a third-party resource supports HTTPS. Those are separate problems that other tools address.
If you have a certificate issue, use an SSL checker (e.g., SSL Labs). If the certificate is valid but the padlock is still broken, come back to Srccheck — that is the exact scenario this tool diagnoses.
Known limitations
Srccheck is a young tool. These items are honest descriptions of what is mocked, not built, or outside scope. Nothing listed here is available for use today.
Pro subscription & payment demo only
The Pro tier on the pricing page demonstrates a checkout flow, but no actual payment processor is connected. No real charges, subscriptions, or account data exist. The form collects nothing server-side.
User accounts not built
There is no user account system. No registration, login, profile, or persistent storage. The scanner is fully functional without one — results are delivered to the browser and discarded when the page is closed. An account system would be needed for Pro features (batch scanning, export, history) and is planned but not yet implemented.
JavaScript-heavy page detection known gap
The scanner parses the HTML as served by the server. Resources injected by JavaScript after page load (single-page app bundles, dynamically created elements, fetch() calls) are not detected. A full client-side scan is a known limitation.
CSS url() references known gap
Only @font-face declarations are parsed for external URLs. Background images and other CSS url() references in linked stylesheets are not extracted. This requires a full CSS parser.
Batch and bulk scanning not built
Scanning multiple URLs at once or programmatic access via API are not available. The scanner processes one URL at a time through the web interface.
Results export not built
There is no way to export scan results as JSON, CSV, or any other format. Results are displayed on screen only and discarded when the page is closed.
Legal entity not registered
No company, legal entity, or jurisdiction has been registered for Srccheck. The operator must establish one before binding terms, a contact address, or payment processing can operate. The copyright notice on the site states this.
Contact us
How to reach support
Srccheck does not yet have a support mailbox or contact address. A contact route will be available once the operator has registered a legal entity.
- Check the FAQs above — most common questions are answered there.
- Review the Terms of Service and Privacy Policy for operational and legal details.
- If you have identified a bug in the scanner, document the URL that triggered it and the expected vs actual behaviour. This will become actionable once a contact route exists.