greatapis

Security — entry 021 of 30

Mozilla http scanner

Verified Jul 2026

The HTTP Observatory grades a website's security headers -- CSP, HSTS, cookie flags, and more -- against Mozilla's recommended baseline, the same engine behind the long-running Mozilla Observatory scanner. The original mozilla/http-observatory Python API was shut down on 2024-10-31 when the tool moved to MDN; automated callers now POST to a v2 scan endpoint that returns a grade, score, and pass/fail counts, with a details link back to the full MDN report. It's fully public and keyless, rate-limited to one fresh scan per host per minute (cached results are returned for repeat calls within that window), and built for CI-pipeline use.

website-securityhttp-headerssecurity-scanningdeveloper-toolsmozilla
Visit developer.mozilla.org ↗Read the docs ↗More Security
AuthenticationNone requiredCall it straight away — no key, no signup.
HTTPSSupportedTraffic is encrypted in transit.
CORSEnabledCallable directly from browser JavaScript.
PricingFreeNo paid tier — free for the documented use case.
FormatsJSONResponses can be requested as JSON.

GreatAPIs Score

Score88out of 100
Authentication25/25No authentication required
Pricing20/20Free to use
Docs14/20Documentation URL provided
Formats9/15Single response format
Freshness20/20Verified within 6 months

Embed this badge

Scored 88 on greatapis.com
<a href="https://greatapis.com/api/mozilla-http-scanner/"><img src="https://greatapis.com/badge/mozilla-http-scanner.svg" alt="Scored 88 on greatapis.com"></a>

Auth quickstart

  1. No key needed — call it now.
Stored keyNo key stored

Your key is stored only in this browser (localStorage) and sent directly to the API — never to greatapis.

Developer reference

Rate limit

1 scan per host per minute (a cached result is returned if exceeded, not a numeric header) -- per the project README's cooldown default.

Featured in

2 collections
No key requiredCORS-ready browser APIs

People comparing Mozilla http scanner also look at…

All 30 →

Mozilla http scanner vs Botd

BotD is FingerprintJS's open-source, MIT-licensed JavaScript library that runs entirely in the browser to flag basic automation -- headless Chrome, PhantomJS, Selenium, and similar tools -- without any server round-trip for the detection itself. It ships as an npm package or as a CDN-hosted ES module and returns a plain detected/bot-kind result object from a single detect() call. It is free for any use with no signup; FingerprintJS separately sells a more sophisticated, paid, server-side Bot Detection API for teams that need those extra signals.

Compare →

Mozilla http scanner vs Microsoft Security Response Center (MSRC)

Mozilla http scanner supports CORS, while Microsoft Security Response Center (MSRC) doesn't — pick Mozilla http scanner for direct browser calls.

Compare →

Mozilla http scanner vs National Vulnerability Database

NIST's NVD API 2.0 is the government's canonical feed of CVE records, each enriched with CVSS scores, CPE product matches, CWE weakness types, and (where applicable) CISA Known Exploited Vulnerabilities flags. It's fully public and keyless, though a free API key lifts the rolling rate limit from 5 to 50 requests per 30 seconds, and NIST recommends polling by lastModStartDate/lastModEndDate rather than re-pulling the whole dataset. The stored URL pointed at a legacy JSON-feed changelog page; corrected to the current "Start Here" developer docs for the 2.0 REST API.

Compare →

Mozilla http scanner vs dead-drop

dead-drop is a minimal, self-hostable API for sharing ephemeral secrets: the client encrypts the payload before it ever reaches the server, so the backend only ever stores ciphertext it cannot read, and each secret can be set to self-destruct after a single view or a time limit. It needs no account or API key — requests are simply rate-limited per IP — and returns plain JSON over a small REST surface. The design mirrors the classic one-time-secret pattern used for sharing passwords or tokens without leaving a permanent copy anywhere.

Compare →

Mozilla http scanner vs FilterLists

Mozilla http scanner supports CORS, while FilterLists doesn't — pick Mozilla http scanner for direct browser calls.

Compare →

Mozilla http scanner vs IPLogs

IPLogs scores an IP address's likelihood of being a VPN, proxy, Tor exit node, or datacenter host by combining 25+ signals -- ASN/PeeringDB classification, TCP/IP and TLS fingerprinting, RTT timing, and active probing -- into a single verdict and confidence score. A single keyless POST to /v1/check (optionally enriched with client-side signals like user-agent, timezone, and WebRTC IP) returns the verdict, a 0-1 risk score, and the matched signals with their weights, run by DigitalD.tech. There's no signup and no enforced rate limit today -- the public endpoint is explicitly fair-use, with dedicated deployments available on request for high-volume callers.

Compare →

UK Police

UK Police data

No auth · CORS

PhishStats

Phishing database

No auth

Censys

Search engine for Internet connected host and devices

API Key · CORS

Complete Criminal Checks

Provides data of offenders from all U.S. States and Pureto Rico

API Key · CORS

Domain Intelligence

DNS, WHOIS/RDAP, SSL, subdomain enumeration, and email security in one parallel call

API Key · CORS

EmailRep

Email address threat and risk prediction

API Key