Mozilla Foundation security engineer April Knight has released a project called Observatory. Observatory is a free website security scanning utility, similar to the SSL Labs and High-Tech Bridge.
The service is developed in Python and available on GitHub. It has been in development for months and was approved for a public release just yesterday.
Observatory is aimed at developers, system administrators, and security professionals who want to configure websites that use modern security protocols.
The Observatory scans each website for the presence of key security features and then rates it with points from 0 to 130, which it then converts into a score from A to F.
In its current form, the script scans and scores for the following services:
Content Security Policy (CSP) status,
cookie files using Secure flag,
Cross-Origin Resource Sharing (CORS) status,
HTTP Public Key Pinning (HPKP) status,
HTTP Strict Transport Security (HSTS) status,
automatic redirection rate from HTTP to HTTPS,
Subresource Integrity (SRI) status,
X-Content-Type-Options status,
X-Frame-Options (XFO) status, and
X-XSS-Protection status.
According to Knight, who has automatically scanned over 1.3 million websites, over 91% of modern websites fail the Observatory's tests.
Download the script
