Why No Padlock Alternative
Why No Padlock answers one question: which insecure resources are breaking the padlock on your page. HTTPS Checker answers that one too — it lists the exact http:// images, scripts and stylesheets browsers block or warn about — and then keeps going: SSL grade, certificate expiry, the HTTP to HTTPS redirect chain, security headers, HTTP/2 and HTTP/3. One scan, one report, free and without signup.
Enter your domain to find what's breaking the padlock — results in seconds.
HTTPS Checker vs Why No Padlock
| Feature | HTTPS Checker | Why No Padlock |
|---|---|---|
| Mixed content detection (insecure images, scripts, CSS) | Yes | Yes |
| List of exact insecure resource URLs | Yes | Yes |
| SSL/TLS grade (A+ to F) | Yes | No |
| Certificate validity & expiry date | Yes | Basic |
| HTTP → HTTPS redirect chain & status codes | Yes | No |
| Security headers (HSTS, CSP, …) | Yes | No |
| HTTP/2 & HTTP/3 (QUIC) | Yes | No |
| CAA & DNSSEC | Yes | No |
| Bulk check | Up to 10 domains | No |
| PDF / JSON export & shareable report | Yes | No |
| Free public API | Yes | No |
| Signup required | No | No |
Why is the padlock missing?
If your certificate is valid but the browser still shows "Not Secure" or no padlock, the cause is almost always mixed content: the HTTPS page loads at least one resource over plain HTTP. Active mixed content (scripts, iframes, stylesheets) is blocked outright by modern browsers; passive mixed content (images, video) triggers a warning. The fix is to update those URLs to https:// — our report lists each one, and the mixed content guide walks through fixing them in WordPress, Nginx and Cloudflare.
Less common causes include an incomplete certificate chain (works in some browsers, fails in others — see the certificate chain guide) and a missing HTTP to HTTPS redirect leaving visitors on the insecure version (see how to fix the HTTPS redirect). Both are covered in the same report.
Related: