| name | checking-http-security-headers |
| description | Audit a target's HTTP security headers — CSP, HSTS, X-Frame-Options,
X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and the
Cross-Origin trio (COOP, COEP, CORP).
Use when: SOC2 / PCI auditor flagged "missing security headers" or a
Mozilla Observatory grade is below B, OR you need HSTS preload
eligibility for chrome://net-internals.
Threshold: any missing required header on production HTML response,
HSTS max-age below 31536000s (preload requirement), CSP with
'unsafe-inline' or 'unsafe-eval', X-Frame-Options absent AND CSP
frame-ancestors absent (clickjacking), Cache-Control allowing public
cache on authenticated endpoint.
Trigger with: "audit security headers", "check csp", "hsts check",
"header posture".
|
| allowed-tools | ["Read","Bash(python3:*)","Bash(curl:*)"] |
| disallowed-tools | ["Bash(rm:*)","Edit(/etc/*)"] |
| version | 3.30.0 |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| license | MIT |
| compatibility | Designed for Claude Code |
| tags | ["security","http-headers","csp","hsts","pentest"] |
Checking HTTP Security Headers
Overview
HTTP response headers are the cheapest defense-in-depth layer most web
apps ship. Each header closes one specific attack class — HSTS forces
HTTPS, CSP blocks script injection, X-Frame-Options blocks clickjacking,
etc. Missing headers don't break the app; they just leave the attack
class open. This skill probes for the presence + value correctness of
the canonical security-relevant headers.
When the skill produces findings
| Finding | Severity | Threshold | Affected control |
|---|
| HSTS header missing | HIGH | No Strict-Transport-Security on HTTPS response | OWASP A05:2021 |
| HSTS max-age below preload threshold | MEDIUM | max-age under 31536000s (1y) | hstspreload.org |
| HSTS includeSubDomains missing for preload | LOW | preload directive without includeSubDomains | hstspreload.org |
| CSP header missing | HIGH | No Content-Security-Policy header | OWASP A03:2021 |
| CSP allows unsafe-inline | MEDIUM | script-src or style-src includes 'unsafe-inline' | OWASP A03:2021 |
| CSP allows unsafe-eval | MEDIUM | script-src includes 'unsafe-eval' | OWASP A03:2021 |
| CSP frame-ancestors AND X-Frame-Options both missing | HIGH | Clickjacking open | CWE-1021 |
| X-Content-Type-Options:nosniff missing | MEDIUM | MIME-sniff attack open | OWASP A05:2021 |
| Referrer-Policy missing or unsafe-url | MEDIUM | Cross-origin URL leakage | OWASP A05:2021 |
| Permissions-Policy missing | LOW | Camera/mic/geo permissions unrestricted | Permissions Policy spec |
| Server: header discloses version | LOW | nginx/1.18.0 → fingerprintable | CWE-200 |
| Cache-Control public on authenticated response | HIGH |
