Mixed Content Checker - Insecure Content Scanner for HTTPS

Mixed Content Checker: Insecure Content Scanner for HTTPS Pages

Mixed Content Checker scans an HTTPS page for images, scripts, stylesheets, iframes and media still loaded over insecure http://, the cause of a broken padlock, at $0.02 per URL on the Apify Free plan.

• Price: $0.02 per URL checked on the Free plan, less on paid plans.
• Example input: { "url": "https://example.com" }
• Output fields: url, finalUrl, https, mixedContentCount, mixedContent, issues, summary, error

Find insecure http:// resources loaded on an HTTPS page — the "mixed content" that browsers block and that breaks the padlock. One call, no API key, pay per URL.

▶ Live on the Apify Store: https://apify.com/eliai/mixed-content-checker — run it instantly, or call it as an agent tool via Apify MCP.

What it does

• Fetches the page and scans every resource reference — img, script, link, iframe, source, video, audio, and CSS url()
• Flags any loaded over insecure http:// while the page is HTTPS
• Returns the list of offending resources (with type, up to 50 per page) + issues

Input

{ "url": "https://example.com" }

or bulk:

{ "urls": ["https://a.com", "https://b.com"], "maxUrls": 25 }

Output (per URL)

{
  "url": "https://example.com",
  "https": true,
  "mixedContentCount": 2,
  "mixedContent": [{ "type": "img", "url": "http://example.com/logo.png" }],
  "issues": ["2 insecure http:// resource(s) on an HTTPS page — browsers block/warn (mixed content)"],
  "summary": "2 mixed-content resource(s)"
}

Use cases

Security/SSL audits, pre-launch checks, and fixing the broken-padlock warning — by hand or wired into an agent/CI. Pairs with our HTTP Security Headers Checker.

Pricing

$0.02 per URL checked on the Apify Free plan, billed as the mixed-content-checked event. Paid Apify plans pay less ($0.0186 Bronze, $0.0174 Silver, $0.016 Gold, $0.0146 Platinum, $0.0134 Diamond). No start fee. A URL that cannot be fetched comes back with an error field. Bulk runs are capped by maxUrls (25 by default), which is also your budget cap.

Limits

• Default run settings: 256 MB memory, 600 s timeout. Change them per run under Options if a large input needs more.
• Time: the prefilled example finished in 2 s on 2026-10-31; run time grows with the number of inputs.

FAQ

Why is my HTTPS site "not secure" or missing the padlock? Almost always mixed content — some resource (an image, script, or stylesheet) still loads over plain http://. Run the URL and mixedContent lists every offender with its type.

What's the difference between mixed content being blocked vs just warned about? Browsers hard-block active mixed content (scripts, iframes, stylesheets) because it can hijack the page, and block-or-warn on passive content (images, media). Either way the padlock is gone; the resource type in each result tells you which case you have.

How do I fix mixed content? Usually just switch the reference to https:// — most hosts serve both. For assets on hosts without TLS, re-host them. The per-resource list from this actor is your exact to-do list.

Does it check CSS files too? It scans the page's own HTML, including url() values written in inline CSS — img, script, link, iframe, source, video, audio tags and CSS urls. It does not download linked stylesheet files, so an http:// reference inside an external .css file is not seen.

Can I scan my whole site? Pass your key templates/pages as an array in urls (capped by maxUrls) — mixed content almost always comes from shared layouts, so scanning one page per template catches nearly everything.

Changelog

• 2026-11-01: Page text only: a clearer page heading and a Limits section. Code, output and price are unchanged.

For AI agents

This Actor is built to be called by software, not just by people.

• Mount it directly as an MCP tool — no Store search, no ranking, just this one tool: https://mcp.apify.com/?actors=eliai/mixed-content-checker
• Or call it over HTTP and get the results in the same request: POST https://api.apify.com/v2/acts/eliai~mixed-content-checker/run-sync-get-dataset-items
• Costs are predictable before you call. Pricing is pay-per-event (see Pricing above), so an agent can budget a run in advance instead of discovering the bill afterwards.
• Send only the field you mean. If you pass the bulk field, it is used on its own; the single-value field is a fallback, never merged into your request. You are charged for the items you sent and nothing else.