http-observatory VS engine

Here are a few tools you can use: https://www.zaproxy.org/ (Web app scanner) https://www.ssllabs.com/ssltest/analyze.html?d=importer.bilendo.de (SSL server test) https://github.com/santoru/shcheck (Security Header Check) https://observatory.mozilla.org/ (Content Security Policy validator)

Regular Audits: Use tools like Mozilla Observatory or Security Headers to regularly check your headers.

What's better about this vs. Mozilla Observatory.

https://developer.mozilla.org/en-US/observatory (formerly https://observatory.mozilla.org/)

Or Security Headers?

https://securityheaders.com/

Or VENOM?

https://github.com/oshp/oshp-validator

Applaud the effort, these are things that more devs should be aware of when building websites...

Hey some specific feedback on this tool... On mobile, it has a lot of "view port wobble" and the input fields aren't keyed right, it's just using a straight text input field so you don't get any ".com" buttons as you type. Small UX stuff like that annoy me more than if a page has a privacy policy setup correctly. (=

Detectify once made an offer of making free scans which I took them up on. There are plenty of free Content Security Policy (CSP) and other vulnerability checkers around such as Observatory or Pentest. Shields UP!! will identify which ports you have open.

Website Headers Analyzer (Mozilla)

scan our site with Mozilla Observatory and improve our grade by registering a domain name, enabling HTTPS, adding a certificate and setting security headers

First, for session persistence, go with the default Django session with cookie storage. Set your cookie to HTTP only and ensure your application uses the most common HTTP security headers and controls. Test your application with https://observatory.mozilla.org/ to have an idea of what you're missing.

Mozilla Observatory

It is not just a theory. A special fork of OpenSSL, maintained by Pluralsight author Peter Mosmans, aims to have as many ciphers as possible. This fork is used and recommended by Mozilla Cipherscan, however, it can offer less than two hundred cipher suites, but there are more than three hundred in the different RFCs according to Cipher Suite Info. The majority of them are weak or insecure, which makes it particularly important to be part of the analysis. In addition, it is also true that there are cipher suites that are not on the Cipher Suite Info list, for instance, Russian standard (GOST) cipher suites. These are rarely used cipher suites, but there is an OpenSSL engine that implements them, so they should be checked.