# Mixed Content Auditor (`phoenix2810/mixed-content-auditor`) Actor Audit one public HTTPS page for insecure http:// mixed-content subresources (scripts, stylesheets, images, iframes, media). Returns active vs passive classification, per-resource details, score, and migration recommendations. - **URL**: https://apify.com/phoenix2810/mixed-content-auditor.md - **Developed by:** [Sanskar Jaiswal](https://apify.com/phoenix2810) (community) - **Categories:** Developer tools, SEO tools, Open source - **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks - **User rating**: No ratings yet ## Pricing Pay per usage This Actor is paid per platform usage. The Actor is free to use, and you only pay for the Apify platform usage, which gets cheaper the higher subscription plan you have. Learn more: https://docs.apify.com/platform/actors/running/actors-in-store#pay-per-usage ## What's an Apify Actor? Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows. In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours, and optionally produces a well-defined JSON output, datasets with results, or files in key-value store. In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server. Actors are written with capital "A". ## How to integrate an Actor? If asked about integration, you help developers integrate Actors into their projects. You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready. The best way to integrate Actors is as follows. In JavaScript/TypeScript projects, use official [JavaScript/TypeScript client](https://docs.apify.com/api/client/js/docs.md): ```bash npm install apify-client ``` In Python projects, use official [Python client library](https://docs.apify.com/api/client/python/docs.md): ```bash pip install apify-client ``` In shell scripts, use [Apify CLI](https://docs.apify.com/cli/docs.md): ````bash # MacOS / Linux curl -fsSL https://apify.com/install-cli.sh | bash # Windows irm https://apify.com/install-cli.ps1 | iex ```bash In AI frameworks, you might use the [Apify MCP server](https://docs.apify.com/integrations/mcp.md). If your project is in a different language, use the [REST API](https://docs.apify.com/api/v2.md). For usage examples, see the [API](#api) section below. For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt). # README ## Mixed Content Auditor Fetches one public HTTPS page and parses the returned HTML for insecure `http://` subresources such as scripts, stylesheets, images, media, and iframes. It separates active mixed content (which can execute code in the page) from passive mixed content (images, media) and returns a readiness score with recommendations. Built for security teams, devops engineers, site migration QA, and scheduled monitoring. ### Use cases - Audit landing pages before and after HTTPS migrations. - Verify that third-party tags, widgets, and CDN resources are served over HTTPS. - Monitor high-value pages on a schedule to catch mixed-content regressions. - Feed structured results into QA dashboards or security alerts. ### Input | Field | Type | Description | | --- | --- | --- | | `startUrl` | string | Public HTTP or HTTPS page URL to audit. URLs with credentials and private network targets are rejected. | | `timeoutSeconds` | integer | Request timeout from 3 to 30 seconds. Defaults to 10. | | `maxHtmlBytes` | integer | Maximum page bytes to read before parsing. Defaults to 1 MB and is capped at 2 MB. | ### Output The actor pushes one dataset item per run. | Field | Type | Description | | --- | --- | --- | | `inputUrl` | string | Original URL from input. | | `normalizedInputUrl` | string | Normalized input URL after defaulting the scheme. | | `finalUrl` | string | Final page URL after redirects. | | `ok` | boolean | True when the page fetched successfully and no insecure resources were found. | | `checkedAt` | string | ISO timestamp for the audit. | | `score` | integer | Mixed-content readiness score from 0 to 100. | | `grade` | string | Letter grade from A to F. | | `activeCount` | integer | Insecure active resources found (scripts, stylesheets, iframes, object/embed, video/audio/source). | | `passiveCount` | integer | Insecure passive resources found (images). | | `totalInsecure` | integer | Total insecure `http://` resources found. | | `resources` | array | Per-resource details: tag, URL, attribute, active flag, same-origin flag, speculative HTTPS upgrade URL. | | `issues` | array | Human-readable issues. | | `recommendations` | array | Suggested fixes. | | `error` | string or null | Page-level error, if the initial fetch failed. | ### Example input ```json { "startUrl": "https://example.com/", "timeoutSeconds": 10 } ```` ### Example output ```json { "inputUrl": "https://example.com/", "normalizedInputUrl": "https://example.com/", "finalUrl": "https://example.com/", "ok": true, "checkedAt": "2025-01-01T00:00:00.000Z", "score": 100, "grade": "A", "activeCount": 0, "passiveCount": 0, "totalInsecure": 0, "resources": [], "issues": [], "recommendations": [ "No mixed content detected. Continue serving all subresources over HTTPS." ], "error": null } ``` ### Security - Only public HTTP and HTTPS URLs are fetched. - URLs with usernames or passwords are rejected. - Private IPv4, private IPv6, localhost, link-local, and private DNS resolutions are blocked before fetching. - Redirect destinations are revalidated before they are followed. - Page reads are capped to limit memory use. - The actor does not require logins, cookies, browser sessions, or credentials. ### Pricing | Event | Suggested price | | --- | ---: | | Actor start | `$0.005` | | Page audited | `$0.01` | Suggested launch price: about `$0.015` per audited page. Agencies can schedule the actor for recurring checks on important URLs. ### FAQ #### Does this crawl the whole site? No. It fetches one page and parses the HTML. This keeps runs cheap and predictable. #### Does it check JavaScript-rendered resources? No. It parses the returned HTML. Browser rendering can be added later if customer demand justifies the extra cost and maintenance. #### What is the difference between active and passive mixed content? Active mixed content includes scripts, stylesheets, iframes, and media that can execute code or navigate the page. Passive mixed content includes images that cannot execute code but still trigger browser warnings. Active content is scored more heavily. #### How does the score work? The score starts at 100 and is reduced by 12 points per active resource (up to 60) and 4 points per passive resource (up to 25). The resulting letter grade reflects overall HTTPS migration readiness. # Actor input Schema ## `startUrl` (type: `string`): Public HTTP or HTTPS page URL to audit. ## `timeoutSeconds` (type: `integer`): Request timeout from 3 to 30 seconds. ## `maxHtmlBytes` (type: `integer`): Maximum response bytes to read before parsing. The actor caps this value at 2 MB. ## Actor input object example ```json { "startUrl": "https://example.com/", "timeoutSeconds": 10, "maxHtmlBytes": 1048576 } ``` # Actor output Schema ## `results` (type: `string`): No description # API You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup. ## JavaScript example ```javascript import { ApifyClient } from 'apify-client'; // Initialize the ApifyClient with your Apify API token // Replace the '' with your token const client = new ApifyClient({ token: '', }); // Prepare Actor input const input = { "startUrl": "https://example.com/" }; // Run the Actor and wait for it to finish const run = await client.actor("phoenix2810/mixed-content-auditor").call(input); // Fetch and print Actor results from the run's dataset (if any) console.log('Results from dataset'); console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`); const { items } = await client.dataset(run.defaultDatasetId).listItems(); items.forEach((item) => { console.dir(item); }); // 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs ``` ## Python example ```python from apify_client import ApifyClient # Initialize the ApifyClient with your Apify API token # Replace '' with your token. client = ApifyClient("") # Prepare the Actor input run_input = { "startUrl": "https://example.com/" } # Run the Actor and wait for it to finish run = client.actor("phoenix2810/mixed-content-auditor").call(run_input=run_input) # Fetch and print Actor results from the run's dataset (if there are any) print("💾 Check your data here: https://console.apify.com/storage/datasets/" + run["defaultDatasetId"]) for item in client.dataset(run["defaultDatasetId"]).iterate_items(): print(item) # 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start ``` ## CLI example ```bash echo '{ "startUrl": "https://example.com/" }' | apify call phoenix2810/mixed-content-auditor --silent --output-dataset ``` ## MCP server setup ```json { "mcpServers": { "apify": { "command": "npx", "args": [ "mcp-remote", "https://mcp.apify.com/?tools=phoenix2810/mixed-content-auditor", "--header", "Authorization: Bearer " ] } } } ``` ## OpenAPI specification ```json { "openapi": "3.0.1", "info": { "title": "Mixed Content Auditor", "description": "Audit one public HTTPS page for insecure http:// mixed-content subresources (scripts, stylesheets, images, iframes, media). Returns active vs passive classification, per-resource details, score, and migration recommendations.", "version": "0.1", "x-build-id": "XrhurT0kuBVI1lFev" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/phoenix2810~mixed-content-auditor/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-phoenix2810-mixed-content-auditor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/phoenix2810~mixed-content-auditor/runs": { "post": { "operationId": "runs-sync-phoenix2810-mixed-content-auditor", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/phoenix2810~mixed-content-auditor/run-sync": { "post": { "operationId": "run-sync-phoenix2810-mixed-content-auditor", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "startUrl" ], "properties": { "startUrl": { "title": "Page URL", "type": "string", "description": "Public HTTP or HTTPS page URL to audit." }, "timeoutSeconds": { "title": "Timeout seconds", "minimum": 3, "maximum": 30, "type": "integer", "description": "Request timeout from 3 to 30 seconds.", "default": 10 }, "maxHtmlBytes": { "title": "Maximum HTML bytes", "minimum": 100000, "maximum": 2097152, "type": "integer", "description": "Maximum response bytes to read before parsing. The actor caps this value at 2 MB.", "default": 1048576 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } } ```