SSLBoard as a Mozilla HTTP Observatory alternative
Mozilla’s HTTP Observatory has been the standard free tool for checking HTTP security headers since 2016. It grades your CSP, HSTS, cookie flags, and a handful of other headers, and its documentation on how to fix each finding is genuinely good. If your CSP is broken, Observatory will tell you exactly why.
But headers are only part of the picture. Observatory checks what your server says in its HTTP responses, not how it negotiates TLS, what certificates it serves, or what else is running under your domain. SSLBoard covers that ground.
What is Mozilla HTTP Observatory?
HTTP Observatory is a free scanner originally built at Mozilla by April King. In July 2024 it moved to developer.mozilla.org and became the MDN Observatory, with the old observatory.mozilla.org shut down that October.
You enter a hostname and it runs a set of tests against the HTTP response: Content Security Policy, HTTP Strict Transport Security, cookie security attributes, CORS configuration, Subresource Integrity, redirect behaviour, X-Content-Type-Options, and referrer policy. Each site starts at a baseline score of 100, tests add bonuses or penalties, and the result maps to a grade from A+ down to F. Every finding links to MDN documentation explaining the header and how to configure it.
For auditing one site’s header configuration, it’s hard to beat, and it costs nothing.
Where HTTP Observatory falls short
Observatory is deliberately scoped to HTTP response analysis on a single hostname. That scope leaves real gaps if you’re responsible for a domain rather than a page.
One hostname at a time. Each scan targets exactly one hostname. If your organization runs 40 subdomains, that’s 40 separate scans, and you have to know each hostname exists before you can test it. There’s no way to enter a root domain and see everything underneath it.
Headers only, no TLS analysis. The old Mozilla Observatory included a TLS test. The MDN version dropped it and focuses purely on HTTP data. It performs no TLS handshake analysis, so it can’t tell you which protocol versions your endpoints negotiate, which cipher suites they accept, or whether forward secrecy is in place. A server can score A+ on Observatory while still accepting TLS 1.0 with 3DES.
No certificate visibility. Observatory doesn’t inspect your certificate chain, track expiration dates, or check whether the certificate deployed matches what’s in Certificate Transparency logs. An expired or misissued certificate is invisible to it.
No DNS security checks. DNSSEC and CAA records are out of scope. Observatory never looks at your DNS infrastructure.
No discovery. It won’t find forgotten subdomains, staging hosts, or certificates issued for names you didn’t know about. You test what you already know exists.
No exports, no monitoring. Results live on the MDN page for that hostname. There’s no CSV or JSON export, no shareable org-wide report, and no way to get alerted when something changes. If you want a record, you scan again and take screenshots.
How SSLBoard is different
SSLBoard works at the domain level. You type a domain, and it discovers hostnames via Certificate Transparency logs and DNS enumeration, then performs active TLS handshakes against every resolved IP. A few minutes later you have one report covering your entire public TLS surface.
The report covers certificates (expiration timelines, issuer distribution, key types and sizes), TLS protocol versions with associated CVEs for anything still accepting 1.0 or 1.1, cipher suites mapped to the hosts that accept them (3DES, RC4, EXPORT, NULL, CBC-mode issues), forward secrecy, DNSSEC and CAA policy, and post-quantum key exchange support. HTTP security checks are included too: redirect behaviour and HSTS headers are part of every scan, so you don’t lose the header angle by switching tools.
The findings roll up into a weighted posture score broken down by category, so you can track improvement over time or compare domains. Every report is shareable via a link, with CSV, Markdown, and JSON exports. No account needed.
When to use HTTP Observatory vs. SSLBoard
Observatory is a good fit when you’re deep-diving one site’s header configuration, especially CSP. It’s free, the scoring is transparent, and the linked MDN documentation is the best header reference there is. If you’re tuning a Content Security Policy, use Observatory.
SSLBoard is a better fit when the question is broader than one page’s headers. Before a compliance review, after a certificate rotation, when evaluating a vendor, or any time someone asks “how does our TLS look?” across dozens of hosts you may not even have a complete list of. The two tools overlap on headers but solve different problems.
Getting started
Go to sslboard.com, type your domain, and wait a few minutes. Your first scan is always free, with the full report including score, findings, and per-host breakdowns. No account required.