What Mozilla Observatory does well
Mozilla Observatory was built by Mozilla's web security team (the same people behind Firefox's security features). It's the most authoritative free HTTP security header grader. It checks:
- Content-Security-Policy (with detailed directive scoring)
- Strict-Transport-Security (including preload status)
- X-Frame-Options, X-Content-Type-Options
- Referrer-Policy, Permissions-Policy
- Cross-Origin-* headers (COOP, COEP, CORP)
- Cookies with Secure, HttpOnly, SameSite flags
- Redirection to HTTPS
- Subresource Integrity (SRI) on scripts
- Public Key Pinning (deprecated, but still checked)
Observatory produces a letter grade (A+ to F) that has become a de facto standard in the security community. Showing an A+ from Observatory is a mark of security hygiene.
What ismycodesafe.com adds
We check everything Observatory checks (headers, cookies, SRI, redirects) and then run 130+ additional checks that Observatory doesn't touch:
- SSL/TLS deep analysis: Protocol support, cipher suites, Heartbleed, CRIME (Observatory links to SSL Labs for this)
- OWASP Top 10: All findings mapped to OWASP 2021 categories
- CVE detection: Tech stack fingerprinting with NVD, OSV, and retire.js lookups
- Sensitive file detection: 53 paths (.env, .git, backups, CI configs)
- Threat intelligence: 5 databases (VirusTotal, PhishTank, AlienVault OTX, URLhaus, Spamhaus)
- Shodan integration: Exposed ports and known CVEs for your server IP
- Certificate Transparency: Subdomain discovery via crt.sh
- urlscan.io integration: DOM analysis, technology detection, geolocation
- Port scanning: Detection of exposed databases (MySQL, PostgreSQL, Redis, MongoDB)
- DNS security audit: SPF, DMARC, DKIM, CAA, MTA-STS, TLS-RPT
- CORS testing: Misconfiguration detection beyond header presence
The grading philosophy difference
Mozilla Observatory: Single metric (letter grade) based on header compliance. Great for "am I following best practices?" auditing.
ismycodesafe.com: Security grade (A-F) that aggregates all 160+ checks with OWASP severity weighting. More comprehensive, but less recognized as a "badge of honor."
When to use Observatory specifically
Observatory has two things we don't:
- Permanent public URLs. Observatory scan results get a shareable permalink. You can link your scan result in a README or status page.
- Mozilla brand authority. If you're presenting security audit results to stakeholders, "Graded A+ by Mozilla Observatory" carries weight that a newer tool doesn't.
When to use ismycodesafe.com specifically
If you want one scan that tells you the full security posture of a website — not just headers — you need more checks. Observatory won't tell you:
- Your jQuery version is vulnerable to XSS (CVE-2020-11023)
- Your /.env file is publicly accessible
- Your server IP has 3 open ports with known CVEs
- Your domain is listed on Spamhaus DBL
- You have 12 subdomains you forgot about, including staging.example.com which is still running
ismycodesafe.com checks all of this automatically.
Pricing
Both are free. Observatory is fully free forever (Mozilla public service). ismycodesafe.com offers a free tier for all 160+ checks, with optional premium ($49) for AI-generated remediation reports with code examples.
The honest summary
Mozilla Observatory: Best-in-class HTTP header grading with Mozilla's authority. Use it for header compliance and public-facing badges.
ismycodesafe.com: Observatory-level header checks plus 130+ other security tests in one scan. Use it for comprehensive vulnerability audits.
Using both is free and takes 2 minutes total. There's no reason not to.