MDN HTTP Observatory, the successor of Mozilla Observatory, grades how well your site uses the security headers and cookie settings browsers understand. It is free, fast and a good reference. VibeShip checks headers too, and then the things a header grade cannot see.
Use Observatory for a precise, free grade of your headers, especially to tune a content policy: it scores the values, not just their presence. Use VibeShip to find out what else stands between the live product and production: keys in the page, a database a stranger can read, files left public, outdated PHP, email forgery, legal pages. Observatory is better at judging headers.
Free and without an account, run by MDN since July 2024. It checks content policy, cookies, cross-origin settings, redirects, HSTS, referrer policy and similar, and gives a score from 0 to 145 and a grade from F to A+. It no longer checks the certificate setup.
Sixteen outside checks, of which headers are one, then an extensive scan and, with a subscription, tests behind the login and in the code. Results are sorted into what blocks production, what to do next and what is already in place.
Not a feature-for-feature race: the two tools start from different places and are built for different readers.
| Concern | VibeShip | MDN HTTP Observatory |
|---|---|---|
| Primary outcome | A roadmap to production across security, speed, search, email and legal pages | A score and grade for your HTTP security headers |
| Security headers | Whether each of six is present; values not graded | Scores the values, with bonuses and penalties per test |
| Cookies and redirects | Cookie flags and the secure connection, in the passive scan | Graded in detail |
| Keys in the browser, open Supabase or Firebase data | Checked | Not in scope |
| Private files, admin pages, PHP2Shell | Checked | Not in scope |
| Email forgery, legal pages, speed, search | Checked | Not in scope |
| Behind the login and in the code | With a subscription | Not in scope |
| Public API | No public API | Free scan API |
| Published entry pricing | Free quick check, no signup; free extensive scan with an account; €9.99 a month per site (three-month minimum) for every finding explained, tests behind the login and in the code, with a full refund within 7 days if it isn't useful; or €19.99 once for one report | Free |
Said plainly, because a comparison that only praises one side is an advert.
You want to know everything a stranger can see on the live product and what to fix first, in words a non-developer can act on.
You are tuning headers and want a precise grade of their values, free, as often as you like.
Use it to tighten your content policy and cookie settings until the grade stops moving.
Find what headers can't show and sort it into what blocks production and what comes next.
Claims about Mozilla Observatory were checked on 25 October 2026. Vendor products and prices change; follow the links for current details.
It moved to MDN as the HTTP Observatory in July 2024, and the old site with its TLS and third-party tests was retired in October 2024.
It means your headers are well set. It says nothing about whether your database rules, keys or private files are safe, which is where most small apps actually leak.
Run the free quick check against the site your customers use: sixteen checks from outside, sorted into what blocks production and what to do next. Our scans are best effort: they can miss a weakness or flag one that isn't there. This is advice, not a guarantee, and it doesn't replace a security firm. Your site's safety stays your responsibility.