Mixed Content Checker

Mixed Content Checker scans an HTTPS page for images, scripts, stylesheets, iframes and media still loaded over insecure http://, the cause of a broken padlock, at $0.02 per URL on the Apify Free plan.

• Price: $0.02 per URL checked on the Free plan, less on paid plans.
• Example input: { "url": "https://example.com" }
• Output fields: url, finalUrl, https, mixedContentCount, mixedContent, issues, summary, error

Find insecure http:// resources loaded on an HTTPS page — the "mixed content" that browsers block and that breaks the padlock. One call, no API key, pay per URL.

▶ Live on the Apify Store: https://apify.com/eliai/mixed-content-checker — run it instantly, or call it as an agent tool via Apify MCP.

What it does

• Fetches the page and scans every resource reference — img, script, link, iframe, source, video, audio, and CSS url()
• Flags any loaded over insecure http:// while the page is HTTPS
• Returns the list of offending resources (with type, up to 50 per page) + issues

Input

{ "url": "https://example.com" }

or bulk:

{ "urls": ["https://a.com", "https://b.com"], "maxUrls": 25 }

Output (per URL)

{
  "url": "https://example.com",
  "https": true,
  "mixedContentCount": 2,
  "mixedContent": [{ "type": "img", "url": "http://example.com/logo.png" }],
  "issues": ["2 insecure http:// resource(s) on an HTTPS page — browsers block/warn (mixed content)"],
  "summary": "2 mixed-content resource(s)"
}

Use cases

Security/SSL audits, pre-launch checks, and fixing the broken-padlock warning — by hand or wired into an agent/CI. Pairs with our HTTP Security Headers Checker.

Pricing

$0.02 per URL checked on the Apify Free plan, billed as the mixed-content-checked event. Paid Apify plans pay less ($0.0186 Bronze, $0.0174 Silver, $0.016 Gold, $0.0146 Platinum, $0.0134 Diamond). No start fee. A URL that cannot be fetched comes back with an error field. Bulk runs are capped by maxUrls (25 by default), which is also your budget cap.

FAQ

Why is my HTTPS site "not secure" or missing the padlock? Almost always mixed content — some resource (an image, script, or stylesheet) still loads over plain http://. Run the URL and mixedContent lists every offender with its type.

What's the difference between mixed content being blocked vs just warned about? Browsers hard-block active mixed content (scripts, iframes, stylesheets) because it can hijack the page, and block-or-warn on passive content (images, media). Either way the padlock is gone; the resource type in each result tells you which case you have.

How do I fix mixed content? Usually just switch the reference to https:// — most hosts serve both. For assets on hosts without TLS, re-host them. The per-resource list from this actor is your exact to-do list.

Does it check CSS files too? It scans the page's own HTML, including url() values written in inline CSS — img, script, link, iframe, source, video, audio tags and CSS urls. It does not download linked stylesheet files, so an http:// reference inside an external .css file is not seen.

Can I scan my whole site? Pass your key templates/pages as an array in urls (capped by maxUrls) — mixed content almost always comes from shared layouts, so scanning one page per template catches nearly everything.

For AI agents

This Actor is built to be called by software, not just by people.

• Mount it directly as an MCP tool — no Store search, no ranking, just this one tool: https://mcp.apify.com/?actors=eliai/mixed-content-checker
• Or call it over HTTP and get the results in the same request: POST https://api.apify.com/v2/acts/eliai~mixed-content-checker/run-sync-get-dataset-items
• Costs are predictable before you call. Pricing is pay-per-event (see Pricing above), so an agent can budget a run in advance instead of discovering the bill afterwards.
• Send only the field you mean. If you pass the bulk field, it is used on its own; the single-value field is a fallback, never merged into your request. You are charged for the items you sent and nothing else.