HTTP Observatory
developer.mozilla.org/en-US/observatory
Scans a website's HTTP security headers, such as CSP, HSTS and cookie flags, then grades the result and explains how to fix each issue.
The HTTP Observatory, built by Mozilla and now hosted on MDN, checks the security headers a website sends. Enter a domain and it tests settings such as Content Security Policy, HSTS and cookie flags, gives the site a grade, and explains what to change to improve it.
It was launched in 2016 and has scanned millions of sites. It only looks at configuration that a visitor can already see, so it is safe to run on any site. It is most useful for developers and site owners hardening a website, and the recommendations link to MDN documentation for each header.
Why it is useful
A fast way to find missing security headers on a site you run. Each failed test comes with a short explanation and guidance, so it works as a checklist as well as a score. Run by MDN, formerly hosted by Mozilla.
More in Developer Utilities
Other developer utilities you might not have heard of.
- Grep.appSearch across public GitHub repositories for exact code patterns instantly.
- CarbonCreate and share beautiful images of source code in seconds.
- Shields.ioA service that generates badges for READMEs and websites, showing build status, version, downloads, licence and many other live metrics.
- SquooshBrowser-based image compression tool from Google that supports WebP, AVIF, and advanced codec options.
- CodyAn AI coding assistant developed by Sourcegraph that lives in your IDE and understands your entire codebase to help write and fix code.
- DenoA modern JavaScript and TypeScript runtime with built-in security, native TypeScript support, a standard library, and first-class support for web platform APIs — with a formatter, linter, and test runner included.