security-headers
Installation
SKILL.md
Security Headers
Add HTTP security headers to every response. These are zero-effort, high-impact protections that prevent entire classes of attacks.
The Rule
EVERY HTTP response must include security headers. No exceptions.
Required Headers
| Header | What it prevents | Value |
|---|---|---|
Strict-Transport-Security |
Downgrade attacks, SSL stripping | max-age=31536000; includeSubDomains; preload |
Content-Security-Policy |
XSS, data injection, clickjacking | See CSP section below |
X-Content-Type-Options |
MIME sniffing attacks | nosniff |
X-Frame-Options |
Clickjacking | DENY or SAMEORIGIN |
Referrer-Policy |
Leaking URLs to third parties | strict-origin-when-cross-origin |
Permissions-Policy |
Unauthorized access to device APIs | camera=(), microphone=(), geolocation=() |
X-XSS-Protection |
Legacy XSS filter (older browsers) | 0 (disabled -- CSP is better) |