Securityheaders.com and Mozilla Observatory alternative
Updated
Securityheaders.com and Mozilla Observatory grade your security headers for free. Sitecomb checks headers and the rest of your site's security too.
Checking a whole website usually takes several tools. Sitecomb checks six areas at once, and its full report gives a plain fix for each problem.
Side by side
| What gets checked | securityheaders.com | Mozilla HTTP Observatory | Sitecomb |
|---|---|---|---|
| Security headers | Yes, graded A+ to F | Yes, with other key security settings | Yes |
| Cookie flags (cookie safety settings) | Not listed | Yes | Yes |
| Certificates on every server | Not listed on its pages | Not its focus | Yes |
| TLS version (how the connection is locked) | Not listed on its pages | Not its focus | Yes |
| Old JavaScript code | Not listed on its pages | Not listed on its pages | Yes |
| Email anti-spoofing (SPF, DKIM, DMARC), DNSSEC | Not listed on its pages | Not listed on its pages | Yes |
| Domain expiry date | Not listed on its pages | Not listed on its pages | Yes |
| Privacy, page health, phones, contact, found online | Not listed on its pages | Not listed on its pages | Yes |
| Price | Free | Free | Free score; full report $4.99 (USD; your local price is shown at checkout) |
What the free header checkers do well
- Fast and free. One address in, one grade out.
- A clear standard. They show developers exactly which setting is missing.
Where Sitecomb is different
- Eight kinds of security check, not just headers. Certificates, TLS, headers, cookie flags, old JavaScript, email anti-spoofing, DNSSEC and domain expiry.
- Five more areas. Privacy, page health, phones, contact details and found online.
- Plain words. What a missing header means for your business, and who to ask to fix it.
Common questions
What is a security header?
A short instruction your server sends with each page. It tells browsers how to protect visitors.
Is an F on securityheaders.com an emergency?
Not usually. It's worth fixing, but an expired certificate or a spoofable email domain is often more urgent.
Does Sitecomb test for hacks or malware?
Not directly. It checks whether Google lists your site as unsafe, but it doesn't scan your files for malware.
Get your free score, or read Is my website secure?
Updated: 9 November 2026.
Securityheaders.com and Mozilla Observatory are trademarks of their owners. Sitecomb is not affiliated with or endorsed by them. Comparisons use each tool's public pages as dated above.