checking-http-security-headers

name	checking-http-security-headers
description	Audit a target's HTTP security headers — CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and the Cross-Origin trio (COOP, COEP, CORP). Use when: SOC2 / PCI auditor flagged "missing security headers" or a Mozilla Observatory grade is below B, OR you need HSTS preload eligibility for chrome://net-internals. Threshold: any missing required header on production HTML response, HSTS max-age below 31536000s (preload requirement), CSP with 'unsafe-inline' or 'unsafe-eval', X-Frame-Options absent AND CSP frame-ancestors absent (clickjacking), Cache-Control allowing public cache on authenticated endpoint. Trigger with: "audit security headers", "check csp", "hsts check", "header posture".
allowed-tools	["Read","Bash(python3:*)","Bash(curl:*)"]
disallowed-tools	["Bash(rm:*)","Edit(/etc/*)"]
version	3.30.0
author	Jeremy Longshore <[e-mail]>
license	MIT
compatibility	Designed for Claude Code
tags	["security","http-headers","csp","hsts","pentest"]

Checking HTTP Security Headers

Overview

HTTP response headers are the cheapest defense-in-depth layer most web apps ship. Each header closes one specific attack class — HSTS forces HTTPS, CSP blocks script injection, X-Frame-Options blocks clickjacking, etc. Missing headers don't break the app; they just leave the attack class open. This skill probes for the presence + value correctness of the canonical security-relevant headers.

When the skill produces findings

Finding	Severity	Threshold	Affected control
HSTS header missing	HIGH	No Strict-Transport-Security on HTTPS response	OWASP A05:2021
HSTS max-age below preload threshold	MEDIUM	max-age under 31536000s (1y)	hstspreload.org
HSTS includeSubDomains missing for preload	LOW	preload directive without includeSubDomains	hstspreload.org
CSP header missing	HIGH	No Content-Security-Policy header	OWASP A03:2021
CSP allows unsafe-inline	MEDIUM	script-src or style-src includes 'unsafe-inline'	OWASP A03:2021
CSP allows unsafe-eval	MEDIUM	script-src includes 'unsafe-eval'	OWASP A03:2021
CSP frame-ancestors AND X-Frame-Options both missing	HIGH	Clickjacking open	CWE-1021
X-Content-Type-Options:nosniff missing	MEDIUM	MIME-sniff attack open	OWASP A05:2021
Referrer-Policy missing or unsafe-url	MEDIUM	Cross-origin URL leakage	OWASP A05:2021
Permissions-Policy missing	LOW	Camera/mic/geo permissions unrestricted	Permissions Policy spec
Server: header discloses version	LOW	nginx/1.18.0 → fingerprintable	CWE-200
Cache-Control public on authenticated response	HIGH