Censys vs Mozilla http scanner

Censys grew out of the University of Michigan's ZMap internet-scanning research and now re-scans the full public IPv4 space multiple times a day, fingerprinting open ports, services, and TLS certificates. Its Search API exposes that host and certificate-transparency dataset for asset discovery, exposure monitoring, and threat hunting, and underpins Censys's own attack-surface-management product. Access is account-scoped through an API key, with a limited free community tier and metered paid plans for higher query volume.

The HTTP Observatory grades a website's security headers -- CSP, HSTS, cookie flags, and more -- against Mozilla's recommended baseline, the same engine behind the long-running Mozilla Observatory scanner. The original mozilla/http-observatory Python API was shut down on 2024-10-31 when the tool moved to MDN; automated callers now POST to a v2 scan endpoint that returns a grade, score, and pass/fail counts, with a details link back to the full MDN report. It's fully public and keyless, rate-limited to one fresh scan per host per minute (cached results are returned for repeat calls within that window), and built for CI-pipeline use.