Question 1

What is the Mozilla HTTP Observatory?

Accepted Answer

A free scanner (now maintained by MDN) that grades a site's HTTP security configuration A+ to F across tests like Content-Security-Policy, HSTS, cookie flags, and subresource integrity — the same methodology security teams use for a quick external audit.

Question 2

How is this different from the Security Headers Tool?

Accepted Answer

The Security Headers Tool lists which headers are present. This runs Mozilla's full scoring methodology on top of that — a graded, shareable A+ to F score with per-test point deductions, not just a present/missing list.

Question 3

Why did my score come back lower than expected?

Accepted Answer

Observatory scoring rewards defense-in-depth — a strict CSP, HSTS with preload, and secure cookie flags all stack. Missing even one commonly-skipped header (like Referrer-Policy or Permissions-Policy) can cost several points even on an otherwise well-configured site.

Question 4

Is a low grade a security vulnerability?

Accepted Answer

Not on its own — it reflects HTTP configuration hygiene, which reduces the blast radius of certain attack classes (XSS, clickjacking, MIME sniffing) rather than pointing to an existing exploit. Treat a low grade as hardening work, not an active-breach alarm.

Security Grade Check

Frequently Asked Questions

More Free Tools