HTTP Observatory: analyze your website and review available methods to secure it

Re:HTTP Observatory: analyze your website and review availab... by rmdoss on Saturday August 27, 2016 @12:28PM (#12373003)

Their description doesn't really match what they do:

"Observatory by Mozilla is a project designed to help developers, system administrators, and security professionals configure their sites safely and securely. "

All they check is if you have a few security headers and consider that "secure".

There is a LOT more to website security than adding a few extra headers and HTTPS to your site. Even if you get an A, it doesn't mean anything.

To give an example, Google gets a D, CloudFlare a D, Youtube a C+, etc..

[ Parent | on HN ]

Re:HTTP Observatory: analyze your website and review availab... by elmigranto on Saturday August 27, 2016 @02:38PM (#12373557)

> Google gets a D, CloudFlare a D, Youtube a C+

That is probably due to the non-trivial number of clients which don't support modern stuff (old browser, etc.).

[ Parent | on HN ]

Re:HTTP Observatory: analyze your website and review availab... by viraptor on Saturday August 27, 2016 @07:19PM (#12374617)

I don't see a problem. They don't claim to be a one-stop integrated security scanner for all your website needs. I'd be happy if they explicitly included something like a link to OWASP with "get more detailed info here". But I don't think they're misrepresenting the service.

[ Parent | on HN ]

Re:HTTP Observatory: analyze your website and review availab... by zobzu on Saturday August 27, 2016 @05:30PM (#12374271)

it seems similar to securityheaders.io

[ Parent | on HN ]