Security headers checkers compared: Mozilla HTTP Observatory, securityheaders.com and Defexity
Last updated · 2 min read
All three check a site’s HTTP security headers for free. Mozilla’s HTTP Observatory grades A+ to F on a 0–145 score and has a public API. securityheaders.com, created by Scott Helme and now part of Probely, grades A+ to F. Defexity reports each header as a problem or not, with a fix for your platform, as part of a wider launch check.
Side by side
| Mozilla HTTP Observatory | securityheaders.com | Defexity security headers checker | |
|---|---|---|---|
| Price | Free to use | Free (sponsor-supported) | Free, no account |
| Result | A+ to F; score from 0, up to 145 with bonuses | A+ to F | Each header: problem (with severity), no problem or not checked, plus an overall score |
| Checks beyond headers | Other security configuration | Headers | The rest of the read-only scan: secrets, exposed files, HTTPS, privacy, SEO |
| Fix instructions | Feedback per test | Per header | Config for Vercel, Netlify, Next.js, Cloudflare and nginx, plus a fix prompt per finding |
| API | Yes, public v2 scan API | Yes, API announced (pricing not stated in the post) | API by workspace key |
| Rescan limit | A new result at most every 60 seconds | Not stated | 2 scans per URL per day on the free plan |
What the grades measure
The Observatory starts every site at 100, subtracts penalties, and adds bonuses only if the result is 90 or more, so strong sites can score above 100. securityheaders.com gives one letter grade for the header set. Both grades are good at one thing: showing at a glance whether headers improved after a change.
Defexity does not grade headers on their own. Each header is reported only when it is missing or weak in a way that matters, for example HSTS shorter than 180 days, or a Content-Security-Policy that allows unsafe-inline scripts. A missing Referrer-Policy is not reported, because browsers already default to a safe policy.
When to use which
- A quick, shareable grade, or headers in a CI job through a free API: Mozilla HTTP Observatory.
- The familiar A+ to F header grade many security people quote: securityheaders.com.
- Exact config for your host, a fix prompt for your AI tool, and the rest of a launch check in the same report: Defexity.
Questions
- Why do the three tools give different results for the same site?
- Each weighs headers differently and checks different extras. Treat a grade as a summary, and read the individual findings.
- Can I run them automatically?
- Yes. The Observatory has a public scan API, securityheaders.com announced an API, and Defexity scans can be queued with a workspace API key.
Related Defexity checks
- SEC-004: Missing or weak Strict-Transport-Security header
- SEC-005: Content-Security-Policy missing or permissive
- SEC-006: Missing X-Content-Type-Options: nosniff
- SEC-007: No clickjacking protection
- SEC-008: Referrer-Policy leaks full URLs
- SEC-009: Permissions-Policy uses an ignored syntax
- SEC-010: Server software version disclosed
Sources
Defexity reports potential risks it can see from outside your app. It is not a guarantee of security and not legal advice.