---
title: "Mozilla Observatory-Style Scan — Free A+ Security Grade"
description: "Free website security scanner inspired by Mozilla Observatory. Get an A+ to F security grade plus fix instructions for every failing test."
canonical: "https://lemwatch.com/tools/mozilla-observatory-checker"
source: "https://lemwatch.com"
---

# Mozilla Observatory Scan

> Get a full A+ to F security grade for any site. Tests headers, cookies, mixed content, and Subresource Integrity.

Mozilla Observatory popularised the A+ to F grade for website security and made it normal to demand a CSP on every public site. The original Observatory still works but is unmaintained — this free checker implements the same scoring rubric against the current set of best practices and explains every failing check in language a non-security engineer can act on.

 ## How the grade is calculated

 The score starts at 100 and loses points for missing or weak headers. Hitting 100 earns an A+; 90+ is A; 70+ is B; below 50 is an F. The biggest single lever is Content Security Policy — a strict CSP can swing the score 25 points on its own. The second is HSTS, which combats SSL-stripping man-in-the-middle attacks and is required for browser preload-list inclusion. The remaining headers each contribute 5–10 points.

 ## Content Security Policy without breaking your site

 Most teams avoid CSP because their first attempt blocks Google Tag Manager and the marketing team revolts. The right move is to start in report-only mode (`Content-Security-Policy-Report-Only`) for a week, collect violation reports to an endpoint like Report URI, then promote to enforcing once you've added every legitimate origin to the allow-list. `'unsafe-inline'` should never appear in `script-src`; use nonces or hashes instead.

 ## Why HSTS preload is more than a checkbox

 Browsers normally only enforce HSTS after the first successful HTTPS visit. The preload list is hard-coded into Chrome, Firefox, Safari, and Edge — once you're on it, the browser refuses to make a plaintext HTTP connection to your domain even for the first visit. Removal takes weeks, so think before you submit: every subdomain, including future ones, must serve HTTPS.

 ## Cookie hardening you cannot postpone

 Chrome's third-party cookie phase-out is reshaping cookie defaults — anything without `SameSite=Lax` or `SameSite=None; Secure` will eventually break. `HttpOnly` blocks JavaScript access (and therefore many XSS-based session-stealing attacks). These are one-line changes in every modern framework yet remain the single most common finding in any Observatory-style scan.

 ## What this scan doesn't do

 Header configuration is necessary but not sufficient. A perfect A+ grade tells you the perimeter is hardened — it tells you nothing about SQL injection, broken access control, or hard-coded API keys in your JavaScript bundle. Pair this with a real application-layer scan before you call yourself secure.

## What this tool checks

- Content Security Policy (CSP) presence and strictness
- HTTP Strict Transport Security (HSTS) and preload list
- Cookie flags (Secure, HttpOnly, SameSite)
- Subresource Integrity (SRI) on external scripts
- Cross-Origin Resource Sharing (CORS) configuration
- Referrer-Policy, X-Frame-Options, X-Content-Type-Options

## Why it matters

 A misconfigured site is one CSP gap away from a stored-XSS incident that leaks every logged-in user's session token. Browsers ship more aggressive defaults every release, so a site that scored A two years ago can score D today without a single code change.

## How to fix what it finds

- Ship a strict CSP with `default-src 'self'` and explicit allow-lists
- Set HSTS with `max-age=63072000; includeSubDomains; preload`
- Add `Secure; HttpOnly; SameSite=Lax` to every cookie
- Add `integrity="sha384-..."` to every external `<script>` tag
- Use `Cross-Origin-Opener-Policy: same-origin` for site isolation

## Methodology

 We perform an HTTPS GET against the root of the supplied domain plus three sample sub-pages, capture the full response headers, parse cookies for flags, and inspect the response body for external scripts so we can flag missing Subresource Integrity. CSP and HSTS are evaluated against Mozilla's recommended-baseline reference; we award full marks for strict-dynamic CSPs and partial credit for unsafe-inline-with-nonce configurations. The Observatory scoring formula is reproduced verbatim — same starting score, same point deductions, same letter-grade thresholds — so a 95 here is directly comparable to a 95 from the original Mozilla tool. Scans complete in 3–8 seconds and never run JavaScript against your origin.

## Frequently asked questions

### Is this the official Mozilla Observatory?

 No. The original Observatory is still online but is no longer actively maintained. We implement the same scoring rubric against current header best practice and update our recommendations as browser defaults change.

### What grade should I be aiming for?

 A or A+ for any public-facing site that handles sessions or payments. B is acceptable for static marketing sites. Anything below B is an actionable risk.

### Will adding CSP break my analytics or chat widget?

 It can if you do it carelessly. Always roll out CSP in report-only mode first, collect violations for a week, then add the legitimate origins (Google Analytics, Intercom, Stripe, etc.) to the allow-list before enforcing.

### Should I submit to the HSTS preload list?

 Yes if your entire domain — every subdomain, current and future — is HTTPS-only and will stay that way. Preload removal takes weeks and is highly disruptive.

### Why is SameSite=Lax now expected on cookies?

 Chrome treats cookies without an explicit SameSite attribute as Lax by default, and is phasing out third-party cookies entirely. Setting the flag explicitly avoids surprises and silences scanner warnings.


## Related

- [All free tools](https://lemwatch.com/tools)
- [Security Headers](https://lemwatch.com/tools/security-header-checker)
- [SSL Checker](https://lemwatch.com/tools/ssl-checker)
- [mixed content checker](https://lemwatch.com/tools/mixed-content-checker)
- [PWA Readiness Checker](https://lemwatch.com/tools/pwa-readiness-checker)
- [Image Optimization Checker](https://lemwatch.com/tools/image-optimization-checker)
- [Lemwatch pricing](https://lemwatch.com/pricing)
- [All monitoring checks](https://lemwatch.com/features)