What Mozilla/MDN HTTP Observatory measures
The scan checks security headers, cookie flags, cross origin resource sharing rules, redirect behaviour from HTTP to HTTPS, and whether external scripts carry integrity hashes. Each check adds or subtracts points from a score out of 100 and a letter grade.
How to read your result
The scoring is strict on purpose, so a middling grade is common even on well run sites. Read the individual rows rather than the total, because a single missing Content Security Policy can cost enough points to drag a site from a B to an F while everything else is fine.
What to change first
Check the redirect row first. A site that serves both HTTP and HTTPS without redirecting is the one real problem this scan finds most often, and it is a single server rule to fix.
Common questions
- How is this different from the Security Headers test?
- Observatory checks headers plus cookies, CORS, redirects and script integrity, so it covers more ground with a stricter score.
- Is a B grade bad?
- No. The scoring is deliberately demanding, and most sites without a Content Security Policy land in that range.
Related tests
Run this alongside every other test in Website Security Checks, or start from the full list of website testing tools.