Mozilla http scanner API

Beginner's Pick Security / No Auth Required Beginner HTTPS
Free to Use Varies (check documentation)

Overview

Mozilla's HTTP Observatory API scans websites and grades their HTTP security configuration, checking for headers like CSP, HSTS, X-Frame-Options, and more. It is completely free with no authentication required, making it an excellent tool for developers who want to audit and improve their site's security posture. The API powers the observatory.mozilla.org web interface.

Beginner Tip

Trigger a new scan with a POST request, then retrieve results with a GET request using the same hostname. Results are cached, so if you need a fresh scan, set the "rescan" flag to true in your POST body.

Available Data

Mozilla http scanner data via REST API

Example Response

JSON Response
{
  "status": "success",
  "data": {
    "result": "Data from Mozilla http scanner",
    "description": "Mozilla observatory http scanner",
    "timestamp": "2025-01-15T10:00:00Z"
  }
}

Field Reference

grade Letter grade for the site's HTTP security (A+ to F).
score Numeric security score out of 100.
state Current scan state: PENDING, RUNNING, FINISHED, or FAILED.
tests_passed Number of individual security header tests that passed.
tests_failed Number of security header tests that failed.

Implementation Example

Request
// ⚠️ Note: This URL may be a documentation page. Check official docs for actual API endpoint.
const url = "https://github.com/mozilla/http-observatory/blob/master/httpobs/docs/";
const response = await fetch(url);
if (!response.ok) throw new Error(`Request failed: ${response.status}`);
const data = await response.json();
console.log(data);

What Can You Build?

Note: These code examples are AI-generated and unverified. Always refer to the official API documentation for accurate usage.

Common Errors & Troubleshooting

Scanner returns "pending" state The scan has been queued but not yet completed — results take a few seconds to generate.
Poll the GET endpoint every 2-3 seconds until the state changes from "PENDING" or "RUNNING" to "FINISHED".
Score lower than expected Missing or misconfigured HTTP security headers on the target site.
Review the "tests" object in the response — each failed test explains which header is missing and links to documentation.
Host not reachable error The scanned domain is not publicly accessible or is blocking Mozilla's scanner IPs.
Ensure the site is live and accessible from the public internet before submitting a scan.

Metadata Score Breakdown

Estimated from metadata — endpoint not independently tested

This score is estimated from observable metadata — HTTPS support, authentication model, declared CORS, and documentation reachability — because the API requires authentication or exposes no publicly testable endpoint. The five-signal breakdown is only shown for live-tested APIs.

Metadata estimate · endpoint not independently tested

Technical Specifications

Auth No Auth
HTTPS REQUIRED
CORS UNKNOWN
Category Security
Difficulty Beginner
Verified: 2026-04-07

Related Tags

Similar APIs

View All →