Skip to main content

SecurityHeaders.com API discontinued April 2026. Mozilla Observatory archived. SecScanner is the free replacement — checks all the same headers and more.

Free SecurityHeaders.com & Mozilla Observatory Alternative

SecurityHeaders Alternative — Free HTTP Security Headers Checker

The SecurityHeaders.com API shut down. Mozilla Observatory is archived. SecScanner checks all the same HTTP security headers — plus TLS, DNS, and content vulnerabilities. Free, instant, no signup required.

Results in under 60 seconds62 checks vs SecurityHeaders' 8

Results in seconds · Free · No credit card

Free scan · No signup required · No API key needed

What Happened to SecurityHeaders.com and Mozilla Observatory?

SecurityHeaders.com — API discontinued

In April 2026, Snyk (which acquired SecurityHeaders.com) shut down the paid API tier. Automation workflows, CI/CD integrations, and monitoring scripts that relied on the API stopped working. The web UI at securityheaders.com continues to function but no longer supports programmatic access.

Mozilla Observatory — archived

Mozilla archived the HTTP Observatory repository in 2025. The hosted service continues to run but receives no updates, bug fixes, or new security checks. The project is in maintenance-only mode and will eventually go offline. New web security standards (COOP, COEP, CORP) are not covered.

SecScanner is actively maintained — new checks are added regularly, the codebase is open for security audits, and the API is available on the Pro plan as a drop-in replacement for the discontinued SecurityHeaders API.

SecScanner vs SecurityHeaders.com vs Mozilla Observatory

SecScanner covers everything both tools offered — and adds TLS, DNS, email security, and content checks that neither had.

FeatureSecScannerSecurityHeadersMozilla Obs.
HTTP security headers (CSP, HSTS, X-Frame-Options…)
Cookie security flags (HttpOnly, Secure, SameSite)
Referrer-Policy & Permissions-Policy
Cross-Origin policies (COOP, COEP, CORP)
TLS/SSL certificate validation
Cipher suite & TLS version audit
HSTS preload readiness check
DNS security (SPF, DKIM, DMARC, DNSSEC)
Vulnerable JS library detection
Sensitive file exposure check
Continuous monitoring with alerts
Email & Slack notifications
API access
Actively maintained
Free to use

HTTP Security Headers We Check

23 header checks total — a superset of SecurityHeaders.com and Mozilla Observatory combined. 12 run in every free scan; the rest (CORS, COOP/COEP/CORP) are part of Pro.

Content Security Policy (CSP)

Prevents XSS and data injection by controlling which resources can be loaded.

HTTP Strict Transport Security (HSTS)

Forces browsers to use HTTPS for your domain and prevents protocol downgrade attacks.

Frame Security Policy

Blocks your pages from being embedded in iframes on other sites, preventing clickjacking.

X-Content-Type-Options

Stops browsers from sniffing MIME types and executing files as a different type.

Referrer Policy

Controls how much referrer information is sent with requests from your site.

Permissions-Policy

Restricts access to browser features like camera, microphone, and geolocation.

Cross-Origin Opener Policy (COOP)

Isolates your browsing context from cross-origin documents.

Cross-Origin Embedder Policy (COEP)

Prevents a document from loading cross-origin resources without explicit permission.

Cross-Origin Resource Policy (CORP)

Blocks other sites from loading your resources in their pages.

Set-Cookie Headers

Verifies session cookies are protected with HttpOnly, Secure, and SameSite flags.

Access-Control-Allow-Origin (CORS)

Checks for overly permissive cross-origin request policies.

HSTS Preload Readiness

Evaluates whether your HSTS config meets browser preload list requirements.

Plus 39 more checks across TLS, DNS, email security, and content vulnerabilities

Browse all 62 security checks

Beyond Security Headers

SecurityHeaders.com only checked HTTP response headers. SecScanner checks your entire security posture in one scan.

23
Security Headers
CSP, HSTS, COOP, COEP, CORP, cookies, CORS, and more
10
TLS / SSL
Certificate expiry, cipher suites, TLS version, OCSP stapling
9
DNS & Email
SPF, DKIM, DMARC, DNSSEC, CAA — stop email spoofing
20
Content Security
Vulnerable JS libraries, exposed files, source maps, secrets

How to Migrate from SecurityHeaders.com

1

Run a free scan

Enter your domain at the top of this page. No account or API key needed. Results appear in under 60 seconds, including every header check SecurityHeaders.com graded.

2

Compare your header score

The scan report shows each header check as pass/fail with a risk level and specific fix instructions. Same information as SecurityHeaders.com, plus TLS and DNS results you didn't have before.

3

Replace API calls (Pro)

If you used the SecurityHeaders.com API in CI/CD or monitoring scripts, upgrade to Pro and use the SecScanner REST API at /api/v1/scans. POST a URL, get back JSON with check results — a direct replacement.

4

Set up continuous monitoring (optional)

Instead of running checks manually, add your site to SecScanner monitoring for daily or weekly automated scans with email or Slack alerts when anything changes.

Frequently Asked Questions

Is SecurityHeaders.com shutting down?
The SecurityHeaders.com website (securityheaders.com) remains available as a free web-based checker. However, the paid API was discontinued in April 2026. Any automation that relied on the SecurityHeaders.com API — CI/CD pipelines, monitoring scripts, or integrations — stopped working at that point. SecScanner provides a REST API that covers all the same header checks plus TLS, DNS, and content security.
What happened to Mozilla Observatory?
Mozilla archived the HTTP Observatory repository in 2025. The hosted service at observatory.mozilla.org continues to run but is no longer receiving updates, bug fixes, or new security checks. It will eventually go offline. SecScanner actively maintains all checks and ships new ones regularly.
How do I migrate from SecurityHeaders.com?
Run a free scan on SecScanner — no account required. You'll get the same header checks you relied on (CSP, HSTS, X-Frame-Options, Referrer-Policy, etc.) plus TLS, DNS, and content vulnerability checks. For API automation: replace your SecurityHeaders API calls with SecScanner's v1 API (available on the Pro plan). The response format is JSON with detailed check results and fix recommendations.
Does SecScanner check all the same headers as SecurityHeaders.com?
Yes — SecScanner covers all headers that SecurityHeaders.com graded (CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and cookie security). It adds checks that SecurityHeaders.com did not have: Cross-Origin policies (COOP, COEP, CORP), CORS configuration, cache-control, and 50+ additional checks across TLS, DNS, and content.
Is SecScanner free?
Yes — unlimited scans are free, no account required. The free scan includes 24 checks across headers, TLS, and content — covering every header SecurityHeaders.com and Mozilla Observatory graded (CSP, HSTS, X-Frame-Options, Referrer-Policy, Permissions-Policy, cookie security). The remaining 38 checks — CORS headers, Cross-Origin policies (COOP/COEP/CORP), DNS/email security, and vulnerability scanning — are part of the Pro plan ($19/month), which also adds continuous monitoring, alerts, and API access.
Does SecScanner have an API?
Yes. The Pro plan includes REST API access at /api/v1/scans. Submit a URL, get back structured JSON with check results, pass/fail status, risk level, and fix recommendations for all 62 checks. This is a direct replacement for the discontinued SecurityHeaders.com API.
How does SecScanner compare to Mozilla Observatory?
Mozilla Observatory focused primarily on HTTP headers and basic TLS. SecScanner runs 62 checks across four categories: 23 security headers (a superset of Observatory's), 10 TLS/SSL checks, 20 content checks, and 9 DNS/email security checks (SPF, DKIM, DMARC). Observatory is also archived and no longer maintained.
Can I monitor headers automatically instead of checking manually?
Yes — that's exactly what the Pro plan provides. Add your site to continuous monitoring, pick daily or weekly scans, and SecScanner alerts you via email, Slack, or webhook whenever any header changes. A deployment that removes CSP or HSTS gets flagged before users or attackers notice.

More Free Security Checkers

Headers are just one layer. Explore the full toolkit.

SSL Checker

Certificate expiry, TLS version, cipher suites

Email Security Checker

SPF, DKIM, DMARC for your domain

TLS Checker

TLS 1.2/1.3 support, deprecated versions

Vulnerability Scanner

JS libraries, exposed files, secrets

Ready to Replace SecurityHeaders.com?

Free scan — 24 checks instant, 62 total on Pro, no account required. Or sign up to get continuous monitoring with daily alerts when your headers change.

Start Free ScanView Pricing