Execute qualquer Skill no Manus
com um clique

Execute qualquer Skill no Manus com um clique

Começar

security-headers-csp

Estrelas2

Forks1

Atualizado23 de janeiro de 2026 às 19:25

Best practices for HSTS, CORS, CSP, and security headers.

Instalação

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Executar no Manus

Fonte

sraloff

sraloff/gravityboots

Abrir repositório GitHub Ver repositórios do creator

Download

Executar no Manus

Ocupações relacionadasSOC

Baseado na classificação ocupacional SOC

Analistas de segurança da informaçãoInformática e Matemática·SOC 15-1212

SKILL.md

readonly

name	security-headers-csp
description	Best practices for HSTS, CORS, CSP, and security headers.

Security Headers & CSP

When to use this skill

Configuring web servers (Nginx, Caddy, Apache).
Setting up middleware (Laravel, Express, Django).
Auditing site security.

1. Essential Headers

HSTS: Strict-Transport-Security: max-age=31536000 (1 year).
No Sniff: X-Content-Type-Options: nosniff.
Frame Options: X-Frame-Options: DENY or SAMEORIGIN.

2. Content Security Policy (CSP)

Default: Start with default-src 'self'.
Scripts: Avoid 'unsafe-inline' or 'unsafe-eval'. Use nonces or hashes if inline scripts are necessary.
Reporting: Use report-uri or report-to to monitor violations without breaking the site initially (Content-Security-Policy-Report-Only).

3. CORS

Scope: Only enable CORS if you are serving an API consumed by browsers on different domains.
Origin: Whitelist specific origins; avoid Access-Control-Allow-Origin: * with credentials.

Mais deste repositório

mesmo repositório

project-initialization-bootstrap

sraloff/gravityboots

Bootstraps a new project with standard folder structure, git init, basic files, planning doc skeletons, and initial memory.json. Triggers on new project creation keywords. CRITICAL for first-time setup.

2026-01-232

apache-lamp-config

sraloff/gravityboots

Configuration for Virtual Hosts, .htaccess, and PHP-FPM in LAMP stacks.

2026-01-232

api-design-patterns

sraloff/gravityboots

Principles for REST, GraphQL, versioning, and API authentication.

2026-01-232

assets-icons-fonts

sraloff/gravityboots

Optimization and usage of SVGs, fonts, and static assets.

2026-01-232

bootstrap-legacy

sraloff/gravityboots

Patterns for maintaining or migrating Bootstrap 3/4/5 projects.

2026-01-232

caddy-modern-config

sraloff/gravityboots

Caddyfile configuration, auto-HTTPS, and FastCGI.

2026-01-232

name	security-headers-csp
description	Best practices for HSTS, CORS, CSP, and security headers.

Security Headers & CSP

When to use this skill

Configuring web servers (Nginx, Caddy, Apache).
Setting up middleware (Laravel, Express, Django).
Auditing site security.

1. Essential Headers

HSTS: Strict-Transport-Security: max-age=31536000 (1 year).
No Sniff: X-Content-Type-Options: nosniff.
Frame Options: X-Frame-Options: DENY or SAMEORIGIN.

2. Content Security Policy (CSP)

Default: Start with default-src 'self'.
Scripts: Avoid 'unsafe-inline' or 'unsafe-eval'. Use nonces or hashes if inline scripts are necessary.
Reporting: Use report-uri or report-to to monitor violations without breaking the site initially (Content-Security-Policy-Report-Only).

3. CORS

Scope: Only enable CORS if you are serving an API consumed by browsers on different domains.
Origin: Whitelist specific origins; avoid Access-Control-Allow-Origin: * with credentials.