Mozilla's HTTP Observatory is one of the best-known free website security scanners, so it's a fair thing to compare against. The short version: they're different shapes of tool. Observatory is a hosted scanner you point at a public URL; SurfaceWatch is a browser extension that checks the page you're actually on. Here's an honest look.
What Mozilla Observatory does well
Observatory (now part of MDN) scans a public URL and grades it A+–F, mainly on HTTP security headers plus some TLS and cookie checks, with clear, well-documented scoring and recommendations. It's free, backed by Mozilla's reputation, needs nothing installed, and can be run from anywhere — including scripted against its methodology. For a trusted, public-facing header/TLS grade, it's excellent.
Where it's the better fit: you want a hosted, no-install scan of a public page from a name everyone trusts, or a repeatable grade you can cite to a client or a boss.
What SurfaceWatch does differently
SurfaceWatch runs in your browser, so it checks whatever page you have open — including staging, internal or logged-in pages a hosted scanner can't reach. And it grades more than headers:
- Security headers and HTTPS/HSTS
- Cookie flags as actually set in your browser (Secure, HttpOnly, SameSite)
- Email spoofing — SPF & DMARC
- Outdated JavaScript libraries
- Exposed subdomains from public certificate logs
Every fixable issue comes with a copy-paste fix for nginx, Apache, Netlify, Vercel, Express or your DNS, and Pro adds monitoring and branded client reports.
Side by side
| Mozilla Observatory | SurfaceWatch | |
|---|---|---|
| Type | Hosted scanner | Browser extension |
| Security headers | ✓ (detailed) | ✓ |
| HTTPS / TLS | ✓ | ✓ |
| Cookies / SPF-DMARC / old JS / subdomains | limited | ✓ |
| Checks logged-in / staging pages | – | ✓ |
| Copy-paste fixes per platform | recommendations | ✓ |
| Monitoring / client reports | – | ✓ (Pro) |
| No install needed | ✓ | – |
The honest bottom line
Want a trusted, hosted grade of a public page's headers and TLS? Mozilla Observatory is a great, free choice. Want to check any page you can open — including internal ones — across the whole surface, with the exact fixes and optional monitoring? That's where SurfaceWatch fits. They complement each other more than they compete.
With either tool: everything except Content-Security-Policy is safe to apply as-is. For CSP, roll it out in report-only mode first and tune it to your site.