# Jeremylongshore Claude Code Plugins Plus Skills Analyzing Security Headers

> Analyzing Security Headers

- Skill: `tomevault-io/jeremylongshore-claude-code-plugins-plus-skills-analyzing-se` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/jeremylongshore-claude-code-plugins-plus-skills-analyzing-se`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/jeremylongshore-claude-code-plugins-plus-skills-analyzing-se/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/jeremylongshore-claude-code-plugins-plus-skills-analyzing-se

---

# Analyzing Security Headers

## Overview

Evaluate HTTP response headers for web applications against OWASP Secure Headers Project recommendations and browser security baselines. Identify missing, misconfigured, or information-leaking headers across both HTTP and HTTPS responses.

## Prerequisites

- Target URL or domain name accessible over the network
- Authorization to perform HTTP requests against the target domain
- Network connectivity for both HTTP and HTTPS protocols
- Optional: write access to `${CLAUDE_SKILL_DIR}/security-reports/` for persisting results

## Instructions

1. Accept the target domain. If only a domain name is provided, default to `https://`. For batch analysis, accept a newline-separated list.
2. Fetch response headers using `WebFetch` for both HTTP and HTTPS endpoints. Record the full redirect chain and final destination URL.
3. Evaluate **critical headers** -- flag any that are missing or misconfigured:
   - `Strict-Transport-Security`: require `max-age>=31536000`, `includeSubDomains`, and preload eligibility
   - `Content-Security-Policy`: check for `unsafe-inline`, `unsafe-eval`, overly broad `default-src`, and missing `frame-ancestors`
   - `X-Frame-Options`: require `DENY` or `SAMEORIGIN`
   - `X-Content-Type-Options`: require `nosniff`
   - `Permissions-Policy`: verify camera, microphone, geolocation restrictions
4. Evaluate **important headers** -- report status and recommendations:
   - `Referrer-Policy`: recommend `strict-origin-when-cross-origin` or `no-referrer`
   - `Cross-Origin-Embedder-Policy` (COEP), `Cross-Origin-Opener-Policy` (COOP), `Cross-Origin-Resource-Policy` (CORP)
5. Check for **information disclosure** -- flag `Server`, `X-Powered-By`, `X-AspNet-Version`, and any header revealing technology stack or version numbers.
6. Inspect cookie attributes on `Set-Cookie` headers: verify `Secure`, `HttpOnly`, `SameSite=Lax|Strict`, and `__Host-`/`__Secure-` prefix usage.
7. Calculate a security grade: A+ (95-100), A (85-94), B (75-84), C (65-74), D (50-64), F (<50) based on weighted presence and correctness of each header.
8. Generate per-header remediation directives with configuration examples for Nginx, Apache, and Cloudflare.

See `${CLAUDE_SKILL_DIR}/references/implementation.md` for the five-phase implementation workflow.

## Output

- **Headers Analysis Report**: overall grade, per-header status (present/missing/misconfigured), and risk impact
- **Remediation Checklist**: prioritized fixes with server configuration snippets
- **Cookie Security Assessment**: attribute compliance for each `Set-Cookie` header
- **Comparison Table**: side-by-side HTTP vs. HTTPS header differences

## Error Handling

| Error | Cause | Solution |
|-------|-------|----------|
| Failed to connect to domain | DNS resolution failure, firewall block, or domain down | Verify domain spelling and DNS records; test alternate protocols |
| SSL certificate verification failed | Expired, self-signed, or mismatched certificate | Note TLS issue in report; indicates HSTS not properly enforced |
| Too many redirects | Redirect loop between HTTP and HTTPS | Report the redirect chain and analyze headers at each hop |
| HTTP 429 Too Many Requests | Rate limiting by target server | Implement backoff; queue domain for delayed re-analysis |
| Headers differ between HTTP and HTTPS | Inconsistent server configuration | Report both sets; highlight critical differences and flag HSTS gap |

## Examples

- "Analyze security headers for `https://claudecodeplugins.io` and explain any CSP or HSTS issues."
- "Check headers for `example.com` on both HTTP and HTTPS and provide an Nginx remediation config."
- "Batch-analyze headers for five staging domains and rank them by security grade."

## Resources

- OWASP Secure Headers Project: https://owasp.org/www-project-secure-headers/
- MDN Security Headers Guide: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers#security
- Security Headers Scanner: https://securityheaders.com/
- Content Security Policy Reference: https://content-security-policy.com/
- HSTS Preload Submission: https://hstspreload.org/
- `${CLAUDE_SKILL_DIR}/references/errors.md` -- full error handling reference
- `${CLAUDE_SKILL_DIR}/references/examples.md` -- additional usage examples
- https://intentsolutions.io

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/jeremylongshore) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-11 -->