Mixed Content Auditor

Fetches one public HTTPS page and parses the returned HTML for insecure http:// subresources such as scripts, stylesheets, images, media, and iframes. It separates active mixed content (which can execute code in the page) from passive mixed content (images, media) and returns a readiness score with recommendations. Built for security teams, devops engineers, site migration QA, and scheduled monitoring.

Use cases

• Audit landing pages before and after HTTPS migrations.
• Verify that third-party tags, widgets, and CDN resources are served over HTTPS.
• Monitor high-value pages on a schedule to catch mixed-content regressions.
• Feed structured results into QA dashboards or security alerts.

Input

Field	Type	Description
startUrl	string	Public HTTP or HTTPS page URL to audit. URLs with credentials and private network targets are rejected.
timeoutSeconds	integer	Request timeout from 3 to 30 seconds. Defaults to 10.
maxHtmlBytes	integer	Maximum page bytes to read before parsing. Defaults to 1 MB and is capped at 2 MB.

Output

The actor pushes one dataset item per run.

Field	Type	Description
inputUrl	string	Original URL from input.
normalizedInputUrl	string	Normalized input URL after defaulting the scheme.
finalUrl	string	Final page URL after redirects.
ok	boolean	True when the page fetched successfully and no insecure resources were found.
checkedAt	string	ISO timestamp for the audit.
score	integer	Mixed-content readiness score from 0 to 100.
grade	string	Letter grade from A to F.
activeCount	integer	Insecure active resources found (scripts, stylesheets, iframes, object/embed, video/audio/source).
passiveCount	integer	Insecure passive resources found (images).
totalInsecure	integer	Total insecure http:// resources found.
resources	array	Per-resource details: tag, URL, attribute, active flag, same-origin flag, speculative HTTPS upgrade URL.
issues	array	Human-readable issues.
recommendations	array	Suggested fixes.
error	string or null	Page-level error, if the initial fetch failed.

Example input

{
  "startUrl": "https://example.com/",
  "timeoutSeconds": 10
}

Example output

{
  "inputUrl": "https://example.com/",
  "normalizedInputUrl": "https://example.com/",
  "finalUrl": "https://example.com/",
  "ok": true,
  "checkedAt": "2025-01-01T00:00:00.000Z",
  "score": 100,
  "grade": "A",
  "activeCount": 0,
  "passiveCount": 0,
  "totalInsecure": 0,
  "resources": [],
  "issues": [],
  "recommendations": [
    "No mixed content detected. Continue serving all subresources over HTTPS."
  ],
  "error": null
}

Security

• Only public HTTP and HTTPS URLs are fetched.
• URLs with usernames or passwords are rejected.
• Private IPv4, private IPv6, localhost, link-local, and private DNS resolutions are blocked before fetching.
• Redirect destinations are revalidated before they are followed.
• Page reads are capped to limit memory use.
• The actor does not require logins, cookies, browser sessions, or credentials.

Pricing

Event	Suggested price
Actor start	$0.005
Page audited	$0.01

Suggested launch price: about $0.015 per audited page. Agencies can schedule the actor for recurring checks on important URLs.

FAQ

Does this crawl the whole site?

No. It fetches one page and parses the HTML. This keeps runs cheap and predictable.

Does it check JavaScript-rendered resources?

No. It parses the returned HTML. Browser rendering can be added later if customer demand justifies the extra cost and maintenance.

What is the difference between active and passive mixed content?

Active mixed content includes scripts, stylesheets, iframes, and media that can execute code or navigate the page. Passive mixed content includes images that cannot execute code but still trigger browser warnings. Active content is scored more heavily.

How does the score work?

The score starts at 100 and is reduced by 12 points per active resource (up to 60) and 4 points per passive resource (up to 25). The resulting letter grade reflects overall HTTPS migration readiness.