Mixed Content Checker

Find insecure http:// resources loaded on an HTTPS page — the "mixed content" that browsers block and that breaks the padlock. One call, no API key, pay per URL.

▶ Live on the Apify Store: https://apify.com/eliai/mixed-content-checker — run it instantly, or call it as an agent tool via Apify MCP.

What it does

• Fetches the page and scans every resource reference — img, script, link, iframe, source, video, audio, and CSS url()
• Flags any loaded over insecure http:// while the page is HTTPS
• Returns the list of offending resources (with type) + issues

Input

{ "url": "https://example.com" }

or bulk:

{ "urls": ["https://a.com", "https://b.com"], "maxUrls": 25 }

Output (per URL)

{
  "url": "https://example.com",
  "https": true,
  "mixedContentCount": 2,
  "mixedContent": [{ "type": "img", "url": "http://example.com/logo.png" }],
  "issues": ["2 insecure http:// resource(s) on an HTTPS page — browsers block/warn (mixed content)"],
  "summary": "2 mixed-content resource(s)"
}

Use cases

Security/SSL audits, pre-launch checks, and fixing the broken-padlock warning — by hand or wired into an agent/CI. Pairs with our HTTP Security Headers Checker.

Pricing

$0.02 per URL scanned — billed as the mixed-content-checked event. Bulk runs are capped by maxUrls, which is also your budget cap.

FAQ

Why is my HTTPS site "not secure" or missing the padlock? Almost always mixed content — some resource (an image, script, or stylesheet) still loads over plain http://. Run the URL and mixedContent lists every offender with its type.

What's the difference between mixed content being blocked vs just warned about? Browsers hard-block active mixed content (scripts, iframes, stylesheets) because it can hijack the page, and block-or-warn on passive content (images, media). Either way the padlock is gone; the resource type in each result tells you which case you have.

How do I fix mixed content? Usually just switch the reference to https:// — most hosts serve both. For assets on hosts without TLS, re-host them. The per-resource list from this actor is your exact to-do list.

Does it check CSS files too? It scans the page's resource references including inline CSS url() values — img, script, link, iframe, source, video, audio tags and CSS urls.

Can I scan my whole site? Pass your key templates/pages as an array in urls (capped by maxUrls) — mixed content almost always comes from shared layouts, so scanning one page per template catches nearly everything.

For AI agents

This Actor is built to be called by software, not just by people.

• Mount it directly as an MCP tool — no Store search, no ranking, just this one tool: https://mcp.apify.com/?actors=eliai/mixed-content-checker
• Or call it over HTTP and get the results in the same request: POST https://api.apify.com/v2/acts/eliai~mixed-content-checker/run-sync-get-dataset-items
• Pay with x402, without an Apify account. This Actor is whitelisted for agentic payments, so an agent holding USDC on Base can buy a prepaid token and spend it here. The minimum purchase is $1, the token balance is an absolute spending cap, and it expires 14 days after purchase.
• Costs are predictable before you call. Pricing is pay-per-event (see Pricing above), so an agent can budget a run in advance instead of discovering the bill afterwards.
• Send only the field you mean. If you pass the bulk field, it is used on its own; the single-value field is a fallback, never merged into your request. You are charged for the items you sent and nothing else.