Mozilla http scanner

About Mozilla http scanner

The HTTP Observatory is an API for testing the security configuration of websites on the public internet, developed by Mozilla. It works over HTTP with JSON request and response bodies, and provides endpoints to invoke a new scan of a hostname, retrieve the results of an existing or completed scan, retrieve detailed subtest results (covering checks such as Content Security Policy and Subresource Integrity), retrieve a site's scan history, retrieve the overall distribution of grades across all scans, and retrieve scanner state information.

Scans are rate-limited to no more than once every three minutes per site and return a cached result if the site was scanned within the previous 24 hours, unless a rescan is explicitly requested. Each completed scan produces a score and letter grade (A+ through F) along with counts of passed and failed subtests, and scan results can optionally be hidden from the public recent-results listing.

The API is intended for developers and site operators who want to programmatically assess or monitor the HTTP security posture of their own or other public websites, including querying aggregate grade statistics and historical scan data for a given host.

Key features

• Scans public websites for HTTP security header configuration and assigns a letter grade (A+ to F)
• REST API with JSON responses for invoking and retrieving scans (analyze endpoint)
• Retrieves detailed subtest results covering Content Security Policy, Subresource Integrity, and other checks
• Caches scan results for 24 hours, with an option to force a rescan
• Retrieves recent scans filtered by score range and a host's full scan history
• Provides grade distribution statistics across all scans performed

Frequently asked questions