A Mozilla Observatory alternative that also checks TLS and CVEs
The HTTP Observatory now lives on MDN. It scores a site on HTTP security headers and a set of related browser controls, and it is genuinely good at that job. Its cookie, CORS, and Subresource Integrity checks are more detailed than ours, and if those are what you care about you should use it.
One thing catches people out. The older Mozilla Observatory bundled a TLS Observatory and an SSH Observatory alongside the HTTP tests. That suite was retired in September 2024. The version on MDN today covers HTTP only, and Mozilla has said there are no plans to bring TLS analysis back. If you were using Observatory for certificate and protocol checks, that part is gone.
SecureMonk scores headers, TLS, and known CVEs together in one report, with a single 0-100 score and a plain-language fix for each finding. Free, no signup.
Mozilla Observatory vs SecureMonk
| Capability | MDN HTTP Observatory | SecureMonk |
|---|---|---|
| HTTP security headers | Yes, scored with a grade | Yes, scored, with fixes |
| Cookie flags, CORS, Subresource Integrity | Yes, a strength of the tool | Partial |
| TLS / SSL configuration | No, removed and not planned | Yes, protocols, ciphers, certificate |
| Technology fingerprint and known CVEs | No | Yes, vulnerability scan |
| Single score across TLS and headers | Header score only | Yes, 0-100 unified score |
| AI assistant to explain findings | No | Yes, Ask Monk |
| Free, no signup | Yes | Yes |
When to use which
Use the HTTP Observatory when you want a deep, browser-centric read on headers and the surrounding controls. Its cookie and CORS analysis is thorough, the recommendations are well-written, and it comes from the people who work on the browser side of these standards.
Use SecureMonk when you need TLS in the same report. Since the TLS Observatory was retired, checking headers on MDN and then certificates somewhere else means two tools and two scores that do not add up to anything. SecureMonk gives you one number covering both, plus a CVE check on the software behind the site.
What SecureMonk adds
- TLS and certificates: protocol versions, cipher suites, certificate validity and chain. See TLS cipher suites explained.
- Known vulnerabilities: technology fingerprinting matched against CVE and public exploit data.
- One 0-100 score weighted evenly between TLS and headers. See how the score works.
- Ask Monk, an assistant that answers questions about your specific findings.
Common questions
Did Mozilla Observatory shut down? Not the HTTP part. It moved to MDN and is still running. The TLS Observatory and SSH Observatory that used to sit beside it were retired in 2024.
Is SecureMonk free? Yes. No account, no payment, no trial.
Does SecureMonk check cookies and CORS? Partially. Observatory goes deeper there. We put our depth into TLS and vulnerability detection instead, which is the side Observatory no longer covers.