April King, a security engineer at Mozilla, found that the vast majority of the world\u2019s largest sites \u2013 93.45% to be exact<\/a> \u2013 are not implementing many modern security technologies which provide secure connections to their users and protect them from attacks such as cross-site scripting (CSS) and content injection.<\/span><\/p>\n The assessment of these sites was made by Mozilla\u2019s own Observatory tool<\/a> (which King designed). It conducts 11 different tests to see what security technologies a website is using, including HTTPS, HPKP (Key Pinning), CSP (Content Security Policy), and Subresource Integrity. It also scores sites on how well they use those technologies. Websites with sub-par configurations \u2013 like supporting HTTPS without automatically redirecting users \u2013 receive penalties.<\/p>\n King used her Observatory tool to automate scans of Alexa\u2019s Top Million list, which ranks the world\u2019s million largest websites. Her first scan took place in August 2016. To measure improvement, the Top Million were rechecked In October 2016, and again in June 2017. In the first scan 97.6% of sites failed the Observatory\u2019s grading. Over the last 15 months, 42,000 websites have improved their security and no longer receive an F grade<\/p>\n While a 90%+ failure rate might make you feel like everything is terrible, the measured improvement is astounding. In fact, given that many of these technologies are new, and that integrating them into existing sites is so difficult, it\u2019s encouraging to see adoption growing so quickly.<\/p>\n The number of B & C grades has risen by 207% and 330%, respectively. The number of sites receiving an A or A+ grade increased from 90 to 420. To receive an \u201cA\u201d grade you need to implement nearly every technology that the Observatory assesses.<\/p>\n The Mozilla Observatory has played a direct part in these improvements. King noted that 50,000 sites used the tool, made improvements, and then rechecked their grade to make sure they implemented the security measures correctly.<\/p>\n Failing the Observatory\u2019s grading isn\u2019t as bad as it sounds. Compared to similar tools, Observatory has higher standards and grades accordingly. For instance, without CSP, which is an incredibly important but also hard to implement technology, the best grade a website can get is a B+.<\/p>\n The Observatory tool has been used to scan more than 1.55 million different websites and assess their use of security technologies and protocols. \u00a0While the prospect of receiving an F grade may be scary, it\u2019s a great (and free!) way to learn about what technologies are out there and how your site could benefit from them.<\/p>\n No one \u2013 not even expert engineers like King \u2013 expect you to fix everything overnight. It took major websites like The New York Times two years just to deploy HTTPS<\/a> across their entire site. So give your site a scan<\/a> and see how you stack up!<\/p>\n","protected":false},"excerpt":{"rendered":" Mozilla\u2019s Observatory Tool Assess Website Security \u2013 And Many Fall Short. April King, a security engineer at Mozilla, found that the vast majority of the world\u2019s largest sites \u2013 93.45%…<\/p>\n","protected":false},"author":2,"featured_media":4378,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":"","tve_updated_post":"","tve_custom_css":"","tve_user_custom_css":"","tve_globals":{},"tcb2_ready":0,"tcb_editor_enabled":0,"tve_landing_page":"","_tve_header":"","_tve_footer":""},"categories":[16],"tags":[192],"class_list":["post-4376","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hashing-out-cyber-security","tag-mozilla","post-with-tags"],"views":10526,"jetpack_featured_media_url":"https:\/\/www.thesslstore.com\/blog\/wp-content\/uploads\/2017\/07\/iStock-488239848.jpg","_links":{"self":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/4376","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/comments?post=4376"}],"version-history":[{"count":0,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/posts\/4376\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media\/4378"}],"wp:attachment":[{"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/media?parent=4376"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/categories?post=4376"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.thesslstore.com\/blog\/wp-json\/wp\/v2\/tags?post=4376"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}