Run any Skill in Manus with one click

Get Started

security-headers-csp

Stars2

Forks1

UpdatedJanuary 23, 2026 at 19:25

Best practices for HSTS, CORS, CSP, and security headers.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

sraloff

sraloff/gravityboots

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name	security-headers-csp
description	Best practices for HSTS, CORS, CSP, and security headers.

Security Headers & CSP

When to use this skill

Configuring web servers (Nginx, Caddy, Apache).
Setting up middleware (Laravel, Express, Django).
Auditing site security.

1. Essential Headers

HSTS: Strict-Transport-Security: max-age=31536000 (1 year).
No Sniff: X-Content-Type-Options: nosniff.
Frame Options: X-Frame-Options: DENY or SAMEORIGIN.

2. Content Security Policy (CSP)

Default: Start with default-src 'self'.
Scripts: Avoid 'unsafe-inline' or 'unsafe-eval'. Use nonces or hashes if inline scripts are necessary.
Reporting: Use report-uri or report-to to monitor violations without breaking the site initially (Content-Security-Policy-Report-Only).

3. CORS

Scope: Only enable CORS if you are serving an API consumed by browsers on different domains.
Origin: Whitelist specific origins; avoid Access-Control-Allow-Origin: * with credentials.

More from this repository

same repository

project-initialization-bootstrap

sraloff/gravityboots

Bootstraps a new project with standard folder structure, git init, basic files, planning doc skeletons, and initial memory.json. Triggers on new project creation keywords. CRITICAL for first-time setup.

2026-01-232

apache-lamp-config

sraloff/gravityboots

Configuration for Virtual Hosts, .htaccess, and PHP-FPM in LAMP stacks.

2026-01-232

api-design-patterns

sraloff/gravityboots

Principles for REST, GraphQL, versioning, and API authentication.

2026-01-232

assets-icons-fonts

sraloff/gravityboots

Optimization and usage of SVGs, fonts, and static assets.

2026-01-232

bootstrap-legacy

sraloff/gravityboots

Patterns for maintaining or migrating Bootstrap 3/4/5 projects.

2026-01-232

caddy-modern-config

sraloff/gravityboots

Caddyfile configuration, auto-HTTPS, and FastCGI.

2026-01-232

name	security-headers-csp
description	Best practices for HSTS, CORS, CSP, and security headers.

Security Headers & CSP

When to use this skill

Configuring web servers (Nginx, Caddy, Apache).
Setting up middleware (Laravel, Express, Django).
Auditing site security.

1. Essential Headers

HSTS: Strict-Transport-Security: max-age=31536000 (1 year).
No Sniff: X-Content-Type-Options: nosniff.
Frame Options: X-Frame-Options: DENY or SAMEORIGIN.

2. Content Security Policy (CSP)

Default: Start with default-src 'self'.
Scripts: Avoid 'unsafe-inline' or 'unsafe-eval'. Use nonces or hashes if inline scripts are necessary.
Reporting: Use report-uri or report-to to monitor violations without breaking the site initially (Content-Security-Policy-Report-Only).

3. CORS

Scope: Only enable CORS if you are serving an API consumed by browsers on different domains.
Origin: Whitelist specific origins; avoid Access-Control-Allow-Origin: * with credentials.