# 1498 Implementation D190b0bf

> Implementation Guide

- Skill: `tools-only/1498-implementation-d190b0bf` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add tools-only/1498-implementation-d190b0bf`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tools-only/1498-implementation-d190b0bf/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Research & Search
- Author: tools-only (https://skillmd.com/u/tools-only)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/tools-only/1498-implementation-d190b0bf

---

# Implementation Guide

1. Collect the target URL/domain and environment context (CDN/proxy, redirects).
2. Fetch response headers (HTTP/HTTPS) and capture redirects/cookies.
3. Compare headers to recommended baselines and score gaps.
4. Provide concrete remediation steps and verify fixes.

### 1. Domain Input Phase

Accept domain specification:
- Full URL with protocol (https://example.com)
- Domain name only (example.com - will test HTTPS first)
- Multiple domains for batch analysis
- Specific paths for header variation testing

### 2. Header Fetching Phase

Retrieve HTTP response headers:
- Make HEAD or GET request to target
- Capture all security-relevant headers
- Test both HTTP and HTTPS responses
- Record redirect chains and final destination

### 3. Analysis Phase

Evaluate each security header against best practices:

**Critical Headers**:
- Strict-Transport-Security (HSTS)
- Content-Security-Policy (CSP)
- X-Frame-Options
- X-Content-Type-Options
- Permissions-Policy

**Important Headers**:
- Referrer-Policy
- Cross-Origin-Embedder-Policy (COEP)
- Cross-Origin-Opener-Policy (COOP)
- Cross-Origin-Resource-Policy (CORP)

**Additional Checks**:
- Server header information disclosure
- X-Powered-By header exposure
- Cookie security attributes (Secure, HttpOnly, SameSite)

### 4. Grading Phase

Calculate security score:
- A+ (95-100): All critical headers properly configured
- A (85-94): Critical headers present, minor issues
- B (75-84): Most headers present, some weaknesses
- C (65-74): Missing critical headers
- D (50-64): Significant security gaps
- F (<50): Multiple critical vulnerabilities

### 5. Report Generation Phase

Create comprehensive report with:
- Overall security grade and numeric score
- Missing headers with impact assessment
- Misconfigured headers with specific issues
- Remediation recommendations with examples
- Priority ranking for fixes