Mozilla Observatory Alternative: Grade Your Security Headers
Looking for the Mozilla Observatory? It now lives on MDN as the HTTP Observatory, and it is still free. The tool above does a similar job: it fetches your page, grades the security headers, cookie flags, HTTP-to-HTTPS redirection and version leaks, and returns an A+ to F grade with a 0 to 100 score.
For a one-off check either works. The differences are in what each one tests, how you automate it and what happens after the scan, which the table and sections cover.
Enterno.io vs MDN HTTP Observatory
| Feature | Enterno.io | MDN HTTP Observatory |
|---|---|---|
| Price | Free on the site · paid plans from $5/mo | Free |
| Free plan | Yes, no sign-up; per-minute rate limit | Yes, no account; scan history per domain is public |
| API | REST API v4 tool "security" and MCP check_security (API key) | Public v2 API, POST /api/v2/scan?host=, no key |
| Grading | Score 0 to 100, grade A+ to F | Starts at 100, bonuses up to 145; grade A+ to F |
| What is tested | Headers incl. COOP/COEP/CORP, cookies, HTTPS redirect, version leaks | 10 tests incl. CSP, cookies, CORS, redirection, SRI |
| Rescan limit | Same URL returns a cached result for 5 minutes | One new scan per host per 60 seconds |
| Self-hosting | No | Yes, open source (MPL-2.0); npx CLI |
| Alert on grade drop | Daily re-scan of monitored URLs on Captain | Not offered on the site |
Free online tool — website security scanner: instant results, no signup.
What the scan above grades
- Security headers: Content-Security-Policy, Strict-Transport-Security (including the preload directive), X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and the cross-origin trio COOP, COEP and CORP.
- Cookies: Secure, HttpOnly and SameSite on cookies set by the page and by same-site redirects on the way to it.
- HTTPS enforcement: whether plain HTTP redirects to HTTPS.
- Information disclosure: version strings in Server, X-Powered-By and ASP.NET headers.
Headers are read from the final response after redirects, and the report flags when a bot wall (a WAF challenge page) answered instead of your origin. Results are cached for five minutes. Deeper single-topic checks live on separate pages: CSP, CORS, cookies and mixed content.
Where the HTTP Observatory is better
- Subresource Integrity and CORS are part of its 10 tests. Our main scan does not grade SRI, and CORS is a separate tool.
- Open source. The scanner is MDN's
mdn-http-observatoryproject under MPL-2.0. You can run it in CI withnpx @mdn/mdn-http-observatory example.comor host your own API. - A public API without a key.
POST https://observatory-api.mdn.mozilla.net/api/v2/scan?host=example.comreturns grade, score and test counts, limited to one new scan per host per minute. - Documented scoring. Sites start at 100, lose points for failures and can earn bonuses up to 145; MDN publishes every modifier.
- Public history of scans per domain, including data kept from the old Observatory.
What changed at Mozilla, and what it means
The HTTP Observatory moved to MDN on 2 July 2024, and the old Mozilla Observatory, with its TLS Observatory, SSH Observatory and third-party tests, was sunset in October 2024. The v1 API was shut down on 31 October 2024; the v2 API replaced it with a shorter response. MDN says the new Observatory does not provide TLS or certificate data and has no plans to add it. It also dropped the X-XSS-Protection test and added a CORP test.
So for certificate and protocol checks you need a second tool. On Enterno that is the SSL checker; for headers alone, see also our SecurityHeaders.com comparison.
Header checks in CI
Both services can fail a build when a grade drops. The Observatory needs no key:
# MDN HTTP Observatory v2 (one new scan per host per minute)
curl -X POST "https://observatory-api.mdn.mozilla.net/api/v2/scan?host=example.com"
# Enterno REST API v4, same scan as the tool above
curl -H "X-API-Key: YOUR_KEY" "https://enterno.io/api/v4/security?url=https://example.com"Compare the returned grade with the one you expect and fail the job on a drop. A key for the Enterno call comes with a free account.
After the scan: keep the grade from slipping
Headers regress quietly: a new CDN rule, a framework upgrade or a proxy can drop HSTS or weaken a CSP. On the Captain plan, the URLs you monitor are re-scanned daily and you get a Telegram or Slack alert when the grade drops by a letter. Every plan, including the free Scout, gets uptime and SSL monitors with email, Telegram, Slack and webhook alerts. For automation, the same scan is available as the security tool in REST API v4 and as check_security over MCP.
Why teams trust us
How it works
Enter site URL
Security headers analyzed
Get grade A–F
What Does the Security Analysis Check?
The tool checks HTTP security headers, SSL/TLS configuration, server info leaks, and protection against common attacks (XSS, clickjacking, MIME sniffing). A grade fromA to F shows overall security level.
Header Analysis
Checking Content-Security-Policy, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and more.
SSL Check
TLS version, certificate expiry, chain of trust, HSTS support.
Leak Detection
Finding exposed server versions, debug modes, open configs, and directories.
Report with Recommendations
Detailed report explaining each issue with specific steps to fix it.
Who uses this
Security teams
HTTP header audit
DevOps
config verification
Developers
CSP & HSTS setup
Auditors
compliance checks
Common Mistakes
Strict-Transport-Security.Server: Apache/2.4.52 helps attackers find exploits. Hide the version.DENY or SAMEORIGIN.nosniff, browsers may misinterpret file types (MIME sniffing).Best Practices
Content-Security-Policy-Report-Only, monitor violations, then enforce.Server, X-Powered-By, X-AspNet-Version from responses.Get more with a free account
Security check history and HTTP security header monitoring.
Sign up freeLearn more
How-to
Glossary
Research
Frequently Asked Questions
Is the Mozilla Observatory still available?
Yes, as the HTTP Observatory on MDN at developer.mozilla.org/en-US/observatory. It moved there in July 2024. The old Mozilla Observatory site, with its TLS and SSH tools, was sunset in October 2024.
Does the HTTP Observatory have an API?
Yes. The v2 API at observatory-api.mdn.mozilla.net/api/v2/scan takes a POST with the host and returns grade, score and test counts. A host can get a new scan once per minute; otherwise a cached result comes back.
Can I self-host the Observatory?
Yes. MDN's mdn-http-observatory is open source under MPL-2.0. You can scan from the command line with npx, or run the API server, which needs a PostgreSQL database.
Will I get the same grade on both tools?
Not necessarily. Each tool weighs tests differently: the Observatory adds bonuses up to 145 points and includes SRI, while our score is 0 to 100 and includes cookie flags and version leaks. Use one tool consistently to track progress.
Does either tool check my TLS configuration?
MDN says the new Observatory does not provide TLS or certificate data. On Enterno, use the SSL checker for the certificate chain, protocols and expiry.
Try the live tool that powered this guide
Free plan — 10 monitors, checks every 5 min, no card required. Upgrade for 1-minute interval and multi-region monitoring.