compare
Mozilla Observatory alternative with fixes for your host
The HTTP Observatory, now hosted by MDN Web Docs, is a free, open source header scanner with a detailed published score. It tests more headers than PwnMyVibeCode does, including Subresource Integrity and the cross origin policies. PwnMyVibeCode grades a smaller set of headers plus your HTTPS redirect and cookies, links every finding to a fix for your host and your AI agent, and adds a full check for leaked keys and public files on your own site.
Checked against each tool's own pages on .
| MDN HTTP Observatory | PwnMyVibeCode | |
|---|---|---|
| Price | Free, open source under MPL 2.0 | Free |
| Score | Starts at 100, up to 145, graded A+ to F | Graded A to F |
| Headers tested | CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer Policy, SRI, CORS, COOP, COEP and CORP | HSTS, CSP, frame protection, nosniff and Referrer Policy |
| Cookies and HTTPS redirect | Yes | Yes |
| TLS and certificates | Not included, per its FAQ | Not included |
| Keys in your JavaScript, public files | Not mentioned on its site | Full check on your own site |
| Scan history | Public for every domain | Not listed; your share link works for 30 days |
| Run it yourself or in CI | Yes, with npx or its API | No, web only |
Where the HTTP Observatory is better
- It tests more headers, including Subresource Integrity and the cross origin opener, embedder and resource policies.
- Its scoring method is published in detail, from a baseline of 100 up to 145.
- It's open source under the Mozilla Public License 2.0, so you can run it yourself with npx or call its API from CI.
- It's developed by Mozilla and hosted by MDN Web Docs.
Where PwnMyVibeCode is better
- Each finding links to a fix page with the change to make and a prompt for your AI agent.
- Header guides for Next.js, Vercel, Netlify, Cloudflare, Express and nginx give you a block to paste.
- The full check goes past headers: leaked keys in your scripts, public .env and .git files, CORS and Supabase or Firebase config.
- Reports aren't listed publicly. The share link works for 30 days and report pages are hidden from search engines.
Which one should you use?
- You want the most thorough header score, or a check in CI: the HTTP Observatory.
- You want the fix spelled out for your host and your AI agent, or you built with AI and want keys and files checked too: PwnMyVibeCode.
- You can use both: the Observatory in CI, and a PwnMyVibeCode full check after big changes.
The PwnMyVibeCode quick check
Grades a site's HTTPS redirect, security headers and cookies from A to F. Free, no signup, GET and HEAD requests only.
Questions
What happened to Mozilla Observatory?
It's now the HTTP Observatory, hosted by MDN Web Docs. The old mozilla/http-observatory repository was archived on November 4, 2024.
Is the MDN HTTP Observatory free?
Its pages show no price or paid plan, and its code is open source under the Mozilla Public License 2.0.
Does the Observatory check TLS certificates?
No. Its FAQ says the new version doesn't include TLS and certificate analysis. Qualys SSL Labs covers that.
Are Observatory scans public?
Yes. Its FAQ says anyone can scan any domain and the scan history for each domain is public.
Does PwnMyVibeCode test as many headers?
No. It grades HSTS, CSP, frame protection, nosniff and Referrer Policy, plus the HTTPS redirect and cookie flags. The Observatory also tests Subresource Integrity and the cross origin policies.