HTTP security headers, CSP & cookie flags

When to use this skill

Use this skill whenever code touches HTTP responses on any WordPress surface:

• Adding response headers (front-end, wp-admin, or wp-login.php).
• Building a Content-Security-Policy, migrating Report-Only to enforced, or wiring script nonces.
• Choosing frame protection without breaking the Customizer preview or oEmbed frames.
• Setting Secure / HttpOnly / SameSite on a custom cookie, or forcing Secure on core auth cookies.
• Deciding what REST responses may reflect into Access-Control-Allow-Origin.
• Reviewing code that calls header(), reads $_SERVER['HTTP_ORIGIN'], or filters wp_headers.

Response headers are the second layer. Output escaping prevents XSS; headers contain the blast radius when escaping was missed somewhere, and they stop whole attack classes escaping cannot: clickjacking, MIME sniffing, and inline script injection. Agents rarely add headers. When they do, they tend to add a blanket CSP that admins disable, or CORS wide open.