HTTP Observatory scan
The MDN HTTP Observatory is Mozilla's open-source scanner. It fetches a site's home page over HTTP and HTTPS, follows the redirects, and runs twelve tests, from Content-Security-Policy quality and cookie flags to subresource integrity and the redirect chain, turning them into a score out of 100 and a letter grade. CertMoni runs the same scanner on its own servers, so the score you see here is the score developer.mozilla.org would give the same host at the same moment, and nothing about your lookup is sent to Mozilla. A scan fetches several pages and can take up to 45 seconds.
How the Observatory scoring works
Every site starts at 100. Each failed test subtracts a fixed penalty, from 5 points for a missing X-Content-Type-Options to 25 for a Content-Security-Policy that allows inline script, and a few best practices add bonus points once a site already scores 90 or more. The letter is read off the final score:
| Grade | Score |
|---|---|
| A+ | 100 |
| A | 90 to 95 |
| A- | 85 |
| B+ | 80 |
| B | 70 to 75 |
| B- | 65 |
| C+ | 60 |
| C | 50 to 55 |
| C- | 45 |
| D+ | 40 |
| D | 30 to 35 |
| D- | 25 |
| F | 0 to 20 |
What it checks
- Content Security Policy strength, including
'unsafe-inline','unsafe-eval', wildcard sources and whether the policy is in a header or only a<meta>tag. - Cookies: Secure, HttpOnly and SameSite flags on every cookie the home page sets.
- Cross-Origin Resource Sharing: whether
Access-Control-Allow-Originopens the site to any origin. - Redirection from HTTP to HTTPS on the same host, before leaving for any other domain.
- Referrer-Policy, Strict-Transport-Security (including the Chromium preload list), X-Content-Type-Options and X-Frame-Options.
- Subresource Integrity on scripts loaded from other origins.
- Cross-Origin-Embedder-Policy, Cross-Origin-Opener-Policy and Cross-Origin-Resource-Policy.
How this differs from the security headers grade
Our security headers checker counts which headers are present, the way securityheaders.com does. The Observatory reads what the headers say: a Content-Security-Policy that is present but permissive scores badly here and fine there. Run both, and pair them with the certificate report for the TLS side.
Scores use the MDN HTTP Observatory algorithm (Mozilla, MPL-2.0), run on CertMoni's servers.