Mozilla Observatory Scan

Mozilla Observatory popularised the A+ to F grade for website security and made it normal to demand a CSP on every public site. The original Observatory still works but is unmaintained — this free checker implements the same scoring rubric against the current set of best practices and explains every failing check in language a non-security engineer can act on.

How the grade is calculated

The score starts at 100 and loses points for missing or weak headers. Hitting 100 earns an A+; 90+ is A; 70+ is B; below 50 is an F. The biggest single lever is Content Security Policy — a strict CSP can swing the score 25 points on its own. The second is HSTS, which combats SSL-stripping man-in-the-middle attacks and is required for browser preload-list inclusion. The remaining headers each contribute 5–10 points.

Content Security Policy without breaking your site

Most teams avoid CSP because their first attempt blocks Google Tag Manager and the marketing team revolts. The right move is to start in report-only mode (Content-Security-Policy-Report-Only) for a week, collect violation reports to an endpoint like Report URI, then promote to enforcing once you've added every legitimate origin to the allow-list. 'unsafe-inline' should never appear in script-src; use nonces or hashes instead.

Why HSTS preload is more than a checkbox

Browsers normally only enforce HSTS after the first successful HTTPS visit. The preload list is hard-coded into Chrome, Firefox, Safari, and Edge — once you're on it, the browser refuses to make a plaintext HTTP connection to your domain even for the first visit. Removal takes weeks, so think before you submit: every subdomain, including future ones, must serve HTTPS.

Cookie hardening you cannot postpone

Chrome's third-party cookie phase-out is reshaping cookie defaults — anything without SameSite=Lax or SameSite=None; Secure will eventually break. HttpOnly blocks JavaScript access (and therefore many XSS-based session-stealing attacks). These are one-line changes in every modern framework yet remain the single most common finding in any Observatory-style scan.

What this scan doesn't do

Header configuration is necessary but not sufficient. A perfect A+ grade tells you the perimeter is hardened — it tells you nothing about SQL injection, broken access control, or hard-coded API keys in your JavaScript bundle. Pair this with a real application-layer scan before you call yourself secure.