analyzing-security-headers

name	analyzing-security-headers
description	Analyze HTTP security headers of web domains to identify vulnerabilities and misconfigurations. Use when you need to audit website security headers, assess header compliance, or get security recommendations for web applications. Trigger with phrases like "analyze security headers", "check HTTP headers", "audit website security headers", or "evaluate CSP and HSTS configuration".
allowed-tools	Read, WebFetch, WebSearch, Grep
version	1.28.0
author	Jeremy Longshore <[e-mail]>
license	MIT
tags	["security","compliance","audit"]
compatibility	Designed for Claude Code

Analyzing Security Headers

Overview

Evaluate HTTP response headers for web applications against OWASP Secure Headers Project recommendations and browser security baselines. Identify missing, misconfigured, or information-leaking headers across both HTTP and HTTPS responses.

Prerequisites

• Target URL or domain name accessible over the network
• Authorization to perform HTTP requests against the target domain
• Network connectivity for both HTTP and HTTPS protocols
• Optional: write access to ${CLAUDE_SKILL_DIR}/security-reports/ for persisting results

Instructions

1. Accept the target domain. If only a domain name is provided, default to https://. For batch analysis, accept a newline-separated list.
2. Fetch response headers using WebFetch for both HTTP and HTTPS endpoints. Record the full redirect chain and final destination URL.
3. Evaluate critical headers -- flag any that are missing or misconfigured:
   • Strict-Transport-Security: require max-age>=31536000, includeSubDomains, and preload eligibility
   • Content-Security-Policy: check for unsafe-inline, unsafe-eval, overly broad default-src, and missing frame-ancestors
   • X-Frame-Options: require DENY or SAMEORIGIN
   • X-Content-Type-Options: require nosniff
   • Permissions-Policy: verify camera, microphone, geolocation restrictions
4. Evaluate important headers -- report status and recommendations:
   • Referrer-Policy: recommend strict-origin-when-cross-origin or no-referrer
   • Cross-Origin-Embedder-Policy (COEP), Cross-Origin-Opener-Policy (COOP), Cross-Origin-Resource-Policy (CORP)
5. Check for information disclosure -- flag Server, X-Powered-By, X-AspNet-Version, and any header revealing technology stack or version numbers.
6. Inspect cookie attributes on Set-Cookie headers: verify , , , and / prefix usage.