Mozilla's HTTP Observatory grades your headers and teaches you what they do. Scan.now checks the same headers plus TLS, cookies, exposed files, old JavaScript and email. Both are free and neither sells you anything.
These two tools have more in common than most. Both are free. Neither shows adverts. Both think the point of a scan is that you understand it afterwards.
Learn there, check here
Use Scan.now to check a real site before you ship it: headers are about a dozen of our 179 checks, and the same run covers TLS, cookies, exposed files, old JavaScript, email authentication and WordPress. Mozilla's Observatory is the better place to read about the subject afterwards.
What each one measures
| HTTP Observatory | Scan.now | |
|---|---|---|
| What it checks | Web security headers and cookies | Headers, cookies, TLS, exposed files, old JavaScript, email, WordPress |
| Number of checks | About a dozen | 179 |
| Teaching material | Excellent, on MDN | 179 check pages and 60 guides |
| Crawls more than one page | No | Yes, up to 25 free |
| Structured data for search engines | None on the page | Yes |
| Price | Free | Free up to 25 pages |
Everything a header grade cannot see
Breadth, on the same visit. The Observatory answers one question well. The same fifteen seconds here also tells you whether your certificate is about to expire, whether your cookies are readable by script, whether your .git folder is public and whether anyone can send email as your domain. An expired certificate takes the whole site down; a missing header rarely does.
More than one page. A one-page check finds the problem in one template. A crawl finds the page nobody remembered. Free scans cover 25 pages and the report says which pages disagreed with each other.
The fix, not the finding. Every failure links to the exact change for your server, so the gap between reading the report and shipping the fix is a copy and a paste.
Mozilla is the better teacher
Its grading is strict in a useful way and its write-ups sit on MDN, which is the best free explanation of web security headers anywhere. It is the better teacher; we are the better check.
Before you ship
Run the broad scan first. If something fails, read our check page for it, paste the fix, and re-run. Keep the Observatory open for the day you want to understand a header properly rather than just set it.
Questions about the two grades
Why do the two grades differ?
Different scopes and different weights. The Observatory grades headers strictly. We weigh headers against TLS, cookies, exposed files and the rest, so the same site can score differently in each. Read the findings rather than the letter.
Is one of them stricter?
On headers, the Observatory. It is deliberately hard to please, which is a reasonable choice for a teaching tool.
Do either of them attack my site?
No. Both are passive. Nothing is exploited, no form is submitted, no password is guessed. Our methodology page lists every request we make.
Also in this series: vs securityheaders.com, vs SSL Labs, vs Sucuri SiteCheck.