# Security Headers

> Web security headers validation and configuration generation

- Skill: `manastalukdar/security-headers` (Agent Skill)
- Install (CLI): `npx skillmds@latest add manastalukdar/security-headers`
- Raw SKILL.md: https://api.skillmd.com/api/skills/manastalukdar/security-headers/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: manastalukdar (https://skillmd.com/u/manastalukdar)
- Updated: 2026-09-10
- Page: https://skillmd.com/skills/manastalukdar/security-headers

---


# Security Headers Validation

I'll analyze and implement web security headers (CSP, HSTS, X-Frame-Options, etc.) to protect against common attacks.

Arguments: `$ARGUMENTS` - URL to check, or framework for configuration generation

## Security Headers Overview

**Essential Headers:**
- **Content-Security-Policy (CSP)** - Prevent XSS and injection attacks
- **Strict-Transport-Security (HSTS)** - Enforce HTTPS
- **X-Frame-Options** - Prevent clickjacking
- **X-Content-Type-Options** - Prevent MIME sniffing
- **Referrer-Policy** - Control referrer information
- **Permissions-Policy** - Feature access control

## Token Optimization

**Expected range**: 400–1,500 tokens (initial), 100 tokens (server not accessible)

**Caching**: Caches header analysis in `.claude/cache/security-headers/` for 7 days.

**Early exit**: Returns immediately if the server is not accessible at the target URL.

**Patterns used**: Grep-before-Read, early exit, git diff scope default, caching, progressive disclosure