The Agent Skills Directory

[SAFE]: The skill provides comprehensive and defensive security guidance for implementing HTTP headers in WordPress, focusing on mitigating XSS, clickjacking, and MIME sniffing.
[SAFE]: Reference implementations correctly use unpredictable per-response nonces generated via random_bytes() for Content Security Policy (CSP), avoiding the common pitfall of reusing CSRF tokens.
[SAFE]: The skill explicitly warns against insecure practices like reflecting Origin headers into CORS responses and provides a secure whitelisting alternative using WordPress core filters.
[SAFE]: The provided code samples cover multiple WordPress attack surfaces, ensuring that wp-admin and wp-login.php are secured alongside the site front-end.

security-headers-csp