# Mixed Content Checker - Insecure Content Scanner for HTTPS (`eliai/mixed-content-checker`) Actor

Checks HTTPS pages for mixed content, as an insecure content scanner for images, scripts, stylesheets, iframes and media still loaded over http://. Returns each insecure resource with its type, a count and an issue summary per URL. For web developers and site owners moving a site to HTTPS.

- **URL**: https://apify.com/eliai/mixed-content-checker.md
- **Developed by:** [Broke to Built](https://apify.com/eliai) (community)
- **Categories:** SEO tools, Developer tools, Automation
- **Features:** Limited permissions
- **Stats:** 3 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $1.60 / 1,000 mixed-content checks

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.
Since this Actor supports Apify Store discounts, the price gets lower the higher subscription plan you have.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

An Actor is a serverless cloud program that runs on the Apify platform. It has two run modes.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.

Apify vocabulary and the platform model are defined once, in the agent quickstart at https://apify.com/agents.md.

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.

Do not guess an integration path. Every one of them is in the agent quickstart at https://apify.com/agents.md: the Apify MCP server, Agent Skills with the Apify CLI, the JavaScript and Python clients, the REST API, and the account-free path for an agent with no human to sign in. It also carries the rule on stating cost before the first paid run.

For examples already wired to this Actor's own input schema, see the [API](#api) section below.

Each client library has reference documentation the quickstart does not restate: [JavaScript/TypeScript](https://docs.apify.com/api/client/js/docs.md) (`npm install apify-client`) and [Python](https://docs.apify.com/api/client/python/docs.md) (`pip install apify-client`).

# README

## Mixed Content Checker: Insecure Content Scanner for HTTPS Pages

**Mixed Content Checker scans an HTTPS page for images, scripts, stylesheets, iframes and media still loaded over insecure http://, the cause of a broken padlock, at $0.02 per URL on the Apify Free plan.**

- **Price:** $0.02 per URL checked on the Free plan, less on paid plans.
- **Example input:** `{ "url": "https://example.com" }`
- **Output fields:** `url`, `finalUrl`, `https`, `mixedContentCount`, `mixedContent`, `issues`, `summary`, `error`

Find insecure `http://` resources loaded on an HTTPS page — the "mixed content" that browsers block and that breaks the padlock. One call, no API key, pay per URL.

**▶ Live on the Apify Store: https://apify.com/eliai/mixed-content-checker** — run it instantly, or call it as an agent tool via Apify MCP.

### What it does

- Fetches the page and scans every resource reference — `img`, `script`, `link`, `iframe`, `source`, `video`, `audio`, and CSS `url()`
- Flags any loaded over insecure **`http://`** while the page is **HTTPS**
- Returns the list of offending resources (with type, up to 50 per page) + issues

### Input

```json
{ "url": "https://example.com" }
```

or bulk:

```json
{ "urls": ["https://a.com", "https://b.com"], "maxUrls": 25 }
```

### Output (per URL)

```json
{
  "url": "https://example.com",
  "https": true,
  "mixedContentCount": 2,
  "mixedContent": [{ "type": "img", "url": "http://example.com/logo.png" }],
  "issues": ["2 insecure http:// resource(s) on an HTTPS page — browsers block/warn (mixed content)"],
  "summary": "2 mixed-content resource(s)"
}
```

### Use cases

Security/SSL audits, pre-launch checks, and fixing the broken-padlock warning — by hand or wired into an agent/CI. Pairs with our [HTTP Security Headers Checker](https://apify.com/eliai/security-headers-checker).

### Pricing

**$0.02 per URL checked on the Apify Free plan**, billed as the `mixed-content-checked` event. Paid
Apify plans pay less ($0.0186 Bronze, $0.0174 Silver, $0.016 Gold, $0.0146 Platinum, $0.0134
Diamond). No start fee. A URL that cannot be fetched comes back with an `error` field. Bulk runs are capped by `maxUrls` (25 by default), which is also
your budget cap.

### Limits

- Default run settings: 256 MB memory, 600 s timeout. Change them per run under Options if a large input needs more.
- Time: the prefilled example finished in 2 s on 2026-10-31; run time grows with the number of inputs.

### FAQ

**Why is my HTTPS site "not secure" or missing the padlock?** Almost always mixed content — some resource (an image, script, or stylesheet) still loads over plain `http://`. Run the URL and `mixedContent` lists every offender with its type.

**What's the difference between mixed content being blocked vs just warned about?** Browsers hard-block *active* mixed content (scripts, iframes, stylesheets) because it can hijack the page, and block-or-warn on *passive* content (images, media). Either way the padlock is gone; the resource type in each result tells you which case you have.

**How do I fix mixed content?** Usually just switch the reference to `https://` — most hosts serve both. For assets on hosts without TLS, re-host them. The per-resource list from this actor is your exact to-do list.

**Does it check CSS files too?** It scans the page's own HTML, including `url()` values written in inline CSS — `img`, `script`, `link`, `iframe`, `source`, `video`, `audio` tags and CSS urls. It does not download linked stylesheet files, so an `http://` reference inside an external `.css` file is not seen.

**Can I scan my whole site?** Pass your key templates/pages as an array in `urls` (capped by `maxUrls`) — mixed content almost always comes from shared layouts, so scanning one page per template catches nearly everything.

### Changelog

- 2026-11-01: Page text only: a clearer page heading and a Limits section. Code, output and price are unchanged.

### For AI agents

This Actor is built to be called by software, not just by people.

- **Mount it directly as an MCP tool** — no Store search, no ranking, just this one tool:
  `https://mcp.apify.com/?actors=eliai/mixed-content-checker`
- **Or call it over HTTP** and get the results in the same request:
  `POST https://api.apify.com/v2/acts/eliai~mixed-content-checker/run-sync-get-dataset-items`
- **Costs are predictable before you call.** Pricing is pay-per-event (see Pricing above), so an agent can budget a run in advance instead of discovering the bill afterwards.
- **Send only the field you mean.** If you pass the bulk field, it is used on its own; the single-value field is a fallback, never merged into your request. You are charged for the items you sent and nothing else.

# Actor input Schema

## `url` (type: `string`):

An HTTPS page to scan for insecure http:// resources

## `urls` (type: `array`):

Multiple pages to scan in one run

## `maxUrls` (type: `integer`):

Maximum number of URLs processed in one run; anything beyond it is skipped, so this also caps the cost.

## Actor input object example

```json
{
  "url": "https://www.apify.com",
  "urls": [],
  "maxUrls": 25
}
```

# Actor output Schema

## `results` (type: `string`):

Every item this run produced. Export as JSON, CSV or Excel from the dataset view.

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "url": "https://www.apify.com",
    "urls": []
};

// Run the Actor and wait for it to finish
const run = await client.actor("eliai/mixed-content-checker").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = {
    "url": "https://www.apify.com",
    "urls": [],
}

# Run the Actor and wait for it to finish
run = client.actor("eliai/mixed-content-checker").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "url": "https://www.apify.com",
  "urls": []
}' |
apify call eliai/mixed-content-checker --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,eliai/mixed-content-checker"
        }
    }
}
```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/dUpePo99Wq49uy5Qp/builds/ATKUABXNelgU6PvYd/openapi.json