Ejecuta cualquier Skill en Manus
con un clic

Ejecuta cualquier Skill en Manus con un clic

Comenzar

security-headers-csp

Estrellas2

Forks1

Actualizado23 de enero de 2026 a las 19:25

Best practices for HSTS, CORS, CSP, and security headers.

Instalación

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Ejecutar en Manus

Fuente

sraloff

sraloff/gravityboots

Abrir repositorio de GitHub Ver repositorios del creador

Descarga

Ejecutar en Manus

Ocupaciones relacionadasSOC

Basado en la clasificación ocupacional SOC

Analistas de seguridad de la informaciónOcupaciones informáticas y matemáticas·SOC 15-1212

SKILL.md

readonly

name	security-headers-csp
description	Best practices for HSTS, CORS, CSP, and security headers.

Security Headers & CSP

When to use this skill

Configuring web servers (Nginx, Caddy, Apache).
Setting up middleware (Laravel, Express, Django).
Auditing site security.

1. Essential Headers

HSTS: Strict-Transport-Security: max-age=31536000 (1 year).
No Sniff: X-Content-Type-Options: nosniff.
Frame Options: X-Frame-Options: DENY or SAMEORIGIN.

2. Content Security Policy (CSP)

Default: Start with default-src 'self'.
Scripts: Avoid 'unsafe-inline' or 'unsafe-eval'. Use nonces or hashes if inline scripts are necessary.
Reporting: Use report-uri or report-to to monitor violations without breaking the site initially (Content-Security-Policy-Report-Only).

3. CORS

Scope: Only enable CORS if you are serving an API consumed by browsers on different domains.
Origin: Whitelist specific origins; avoid Access-Control-Allow-Origin: * with credentials.

Más de este repositorio

mismo repositorio

project-initialization-bootstrap

sraloff/gravityboots

Bootstraps a new project with standard folder structure, git init, basic files, planning doc skeletons, and initial memory.json. Triggers on new project creation keywords. CRITICAL for first-time setup.

2026-01-232

apache-lamp-config

sraloff/gravityboots

Configuration for Virtual Hosts, .htaccess, and PHP-FPM in LAMP stacks.

2026-01-232

api-design-patterns

sraloff/gravityboots

Principles for REST, GraphQL, versioning, and API authentication.

2026-01-232

assets-icons-fonts

sraloff/gravityboots

Optimization and usage of SVGs, fonts, and static assets.

2026-01-232

bootstrap-legacy

sraloff/gravityboots

Patterns for maintaining or migrating Bootstrap 3/4/5 projects.

2026-01-232

caddy-modern-config

sraloff/gravityboots

Caddyfile configuration, auto-HTTPS, and FastCGI.

2026-01-232

name	security-headers-csp
description	Best practices for HSTS, CORS, CSP, and security headers.

Security Headers & CSP

When to use this skill

Configuring web servers (Nginx, Caddy, Apache).
Setting up middleware (Laravel, Express, Django).
Auditing site security.

1. Essential Headers

HSTS: Strict-Transport-Security: max-age=31536000 (1 year).
No Sniff: X-Content-Type-Options: nosniff.
Frame Options: X-Frame-Options: DENY or SAMEORIGIN.

2. Content Security Policy (CSP)

Default: Start with default-src 'self'.
Scripts: Avoid 'unsafe-inline' or 'unsafe-eval'. Use nonces or hashes if inline scripts are necessary.
Reporting: Use report-uri or report-to to monitor violations without breaking the site initially (Content-Security-Policy-Report-Only).

3. CORS

Scope: Only enable CORS if you are serving an API consumed by browsers on different domains.
Origin: Whitelist specific origins; avoid Access-Control-Allow-Origin: * with credentials.