An A+ from Mozilla’s HTTP Observatory is a useful grade for HTTP security headers. It is not a verdict that the website is secure. Mozilla’s own FAQ asks, “If I get an A+ grade, does that mean my site is secure?” and answers no (MDN HTTP Observatory FAQ). The tool checks preventative HTTP measures. It does not test outdated software, SQL injection, vulnerable CMS plugins, or how passwords are stored.
If you searched for a Mozilla Observatory alternative, you may want another header grader, or a scan that continues after the headers are done. This article is about the second request. We build HackerMe, a free automated outside website security scanner. Observatory should stay in your toolkit. HackerMe does a different job.
Only scan a domain you own or have explicit permission to test. Observatory’s FAQ also notes that anyone can scan any domain and that scan history is public.
HTTP Header Checks vs Broader Website Scanning
| MDN HTTP Observatory | HackerMe | |
|---|---|---|
| Job | Grades HTTP security headers and related configuration | Outside website scan. Header checks plus the application and attack-surface checks listed on the public pricing page |
| Starting cost, as published | Free, no account | Free plan: no card, one domain, automatic daily scans |
| Output | Score, letter grade, and documentation for each test | A finding list. Items typically include an explanation, supporting evidence, and a recommended fix |
| What a good result means | Not proof the site is secure, per Mozilla’s FAQ | Not proof the site is secure either. A clean result means these checks did not report a problem |
HTTP Observatory launched in 2016 and moved to MDN on 2 July 2024. The older mozilla.org Observatory, which also bundled TLS, SSH, and third-party tests, was retired. The current tool focuses on HTTP data. It does not currently include the old TLS and certificate analysis tabs.
MDN’s current tests include secure cookies, CORS, Content Security Policy, HSTS, the first HTTP-to-HTTPS redirect on the same hostname, Referrer-Policy, Subresource Integrity, X-Content-Type-Options, frame-ancestors / X-Frame-Options, and Cross-Origin-Resource-Policy. Scoring starts at 100. Grades run from A+ (100 or more) down to F.
The redirect test is picky in a useful way. MDN’s example of a correct chain is http://example.com to https://example.com to https://www.example.com. A jump from the HTTP apex straight to the HTTPS www host is penalized, because HSTS on the apex never gets a chance to stick.
We walk through the same header families, without the grade mechanics, in Website Security Headers: What They Do and How to Check Them. For HSTS rollout, including the lock-out risk of a long max-age, see HSTS for Website Owners. For framing headers, see Clickjacking Protection for Your Website.
What a high grade leaves unchecked
Mozilla says Observatory looks at preventative HTTP measures related to issues such as XSS, manipulator-in-the-middle attacks, cross-domain leakage, insecure cookies, CDN compromises, and improperly issued certificates. It does not test outdated software versions, SQL injection, vulnerable CMS plugins, or how passwords are created and stored. Mozilla tells operators not to neglect those just because the Observatory score is high.
That gap is the case for a second tool. A site can send a careful CSP and still accept a malicious query string. A site can redirect correctly and still ship a JavaScript file that contains a secret.
HackerMe includes security-header checks on its website engines. It does not try to replace Observatory’s public grading system, and it does not publish a 145-point scale. What it adds is a broader outside scan you can run on a schedule. The public pricing page lists application checks such as injection, XSS, CORS, CSRF, and clickjacking on later engines, and attack-surface checks on the EASM engine. Those are categories Observatory does not claim.
Treat each result as something to verify. A missing header is a configuration issue. An application check may be a verified finding or only an indication that needs a developer to confirm. Neither tool’s output means the website is secure.
Illustrative example
This is an illustrative example, not a report from a customer site.
What was found. An HTTPS homepage response includes no Strict-Transport-Security header. The site does redirect visitors from HTTP to HTTPS.
What it means for the owner. A redirect is useful. Without HSTS, a first-time visitor, or a browser whose remembered policy has expired, can still begin on a plain HTTP hop. Observatory will flag this kind of gap. It is a configuration issue. It is not proof that anyone intercepted traffic, and it is not proof that the rest of the application is safe.
What to hand the developer. The URL you checked, the date, and the observation: no Strict-Transport-Security header on that HTTPS response. Ask them to add the header only over HTTPS, after they confirm HTTPS is stable on every host the policy should cover. A long max-age, includeSubDomains, and preload are separate decisions. They can lock you out of HTTP-only hosts if you turn them on too early.
How to verify the fix. Recheck the same HTTPS URL and read the raw response. Confirm the header is present and that max-age matches what you intended. Sample another response type as well, such as an error page. Then re-run Observatory if you still want Mozilla’s grade. A passing header check means that header is in place on the responses you sampled. It does not mean the website is secure.
When to use which
Use Observatory first when you are mid-header work and want a shareable grade plus MDN’s documentation. The tool is free and needs no account.
Use Observatory when you care about HTTP headers specifically. After the 2024 move, it is no longer the place to get a deep TLS cipher report. Qualys SSL Labs remains the specialist that other comparisons keep naming. HackerMe’s Quick engine lists an SSL/TLS check on the pricing page, but that page does not claim the check reproduces SSL Labs.
Use a broader outside scan when the headers are already in good shape and you have never looked at injection, XSS, exposed files, or forgotten hostnames. Use it when you want the check to repeat without opening MDN again.
Do not use HackerMe as a way to avoid learning the headers. If CSP or HSTS is missing, fix that. Observatory’s documentation is the clearer teacher for those specific settings.
A simple sequence:
- Confirm you are allowed to test the domain.
- Run HTTP Observatory and fix the headers you actually need. Do not chase bonus points that break a required third-party script.
- Run an outside vulnerability scan and treat application findings as a separate queue.
- Re-run Observatory after header changes, and re-run the vulnerability scan after application fixes.
HTTP Observatory is free. HackerMe’s Free plan details above come from hackerme.ai/pricing as fetched on 8 November 2026. Mozilla’s test list and the A+ FAQ come from MDN pages fetched the same day, including the Observatory FAQ.
If you searched for a Mozilla Observatory alternative hoping to throw the grader away, keep it. If you searched because an A+ still left you unsure what the site exposes, that unease is exactly what Mozilla’s FAQ describes.
Only scan a domain you own or have explicit permission to test.
Scan your website for FREE — hackerme.ai.
