{"slug":"security-headers-writer","name":"Security Headers Writer: HSTS, CSP, Frames","version":"1.0.2","updated_at":"2026-11-08T10:50:18.411Z","use_when":"Writes the response headers a site is missing, in the format of the person's own host, and keeps the page working. It reads the report line, the current response headers, the file that sets headers and the served head, and gives one line per finding with a fixed code, then a Headers block and a Verify line. It covers a missing or short Strict-Transport-Security, no framing rule, no nosniff, no enforcing Content-Security-Policy (a Report-Only header does not count) and a server version in a header. It enforces only directives that cannot break rendering; script, style, image, font and connect sources go into a Report-Only header built from the origins in the pasted head. It leaves out safe look-alikes: unsafe-inline in style-src only, a long max-age without preload, SAMEORIGIN, a Server header with no number and a missing Referrer-Policy. Exactly No findings. when all is well. Use when a site check reports missing security headers, no HSTS, a short HSTS max-age or a version number in a response header.","not_for":"Reviewing a Content-Security-Policy that is already written, cookie flags, http addresses inside the markup, and hosts or servers not named in the skill, which get headers in the same shape marked unchecked. It reads the pasted headers, files and head; it does not request your site. A Report-Only policy needs the served head, and promoting it is your step.","languages":["en"],"tags":["security-headers","hsts","csp","clickjacking","nginx","netlify","nextjs","cloudflare"],"category":"code","category_url":"https://aiskills402.com/categories/code","keywords":["security headers","nosniff","Strict-Transport-Security"],"faq":[{"q":"Which five findings does the answer report?","a":"A missing or short HSTS header, no framing rule, no nosniff, no enforcing Content-Security-Policy (a Report-Only header does not count and the line says so), and a version number in a response header. The answer then gives one Headers block in your host's own format and a Verify line that checks the home page and one deep page, with the https redirect first when HSTS is involved."},{"q":"How does it keep the page working after the headers go live?","a":"A policy that lists only your own origin for scripts stops inline framework scripts, font hosts and analytics the moment it is enforced, and the page looks broken. The enforcing header carries only framing, plugin and base rules; the script, style, image, font and connect sources go into a Report-Only header built from the origins in your pasted head, and you promote them after reading the reports. HSTS gets no subdomain rule when a plain-http subdomain exists."},{"q":"Does it help Claude Sonnet?","a":"Nobody can say yet. This file was listed before any model was tried on it, so there is no measured gain for Sonnet or Haiku to quote. Runs with and without the file are scheduled for the next weekly usage window, and the page will report what they show, including the case where they show nothing."},{"q":"What does a correct setup return?","a":"The reply is the fixed line No findings. and nothing else. A long max-age without preload, SAMEORIGIN with no frame-ancestors, unsafe-inline in style-src only, a Server header with no number and a missing Referrer-Policy earn no line and no remark."}],"examples":[],"page_url":"https://aiskills402.com/skills/security-headers-writer","markdown_url":"https://aiskills402.com/skills/security-headers-writer.md","image_url":"https://cdn.aiskills402.com/og/skills/security-headers-writer/19908023.png","related_url":"https://api.aiskills402.com/v1/skills/security-headers-writer/related","purchases_count":null,"tested":{"date":"2026-11-08","strong":{"model":"claude-sonnet-5-5 (Claude Code alias \"sonnet\")","verdict":"Not run: the skill was published on 8 November 2026 before its test run, by the owner's decision. No result for this model exists yet."},"weak":{"model":"claude-haiku-5-5 (Claude Code alias \"haiku\")","verdict":"Not run: the skill was published on 8 November 2026 before its test run, by the owner's decision. No result for this model exists yet."},"note":"Cases are written and checked by code in test/cases.json: planted gaps (short or missing HSTS, no framing rule, no nosniff, no enforcing Content-Security-Policy, a version number in a response header) on nginx, Netlify, Next.js and Cloudflare setups, each with a safe look-alike, and one correct setup that must get the exact sentence No findings. The plan is to run each case once per model with and without the skill, one after another, read the answers by hand, and publish the numbers here whatever they show. Until then the file is sold unmeasured: no gain is claimed, there is no Recommended mark and no article. Header facts come from the public documentation of each host, see the changelog.","report_url":null},"price_usd":"0.02","price_micro":20000,"size_bytes":21919,"sha256":"e25047f91e8f1b694f4b2ab0f32da1d8b4dc754e308410bcf0c845112752b9e5","outline":["The answer","Where the headers come from","What is NOT a finding","The codes","The Content-Security-Policy rule","The other headers","What each host documents","Rules","Work in this order","Short example"],"license":{"summary":"Perpetual, non-exclusive; use and modify for yourself incl. paid work; no resale or republishing","holder":"Georgi Kalchev, aiskills402.com","url":"https://aiskills402.com/docs#license"},"buy_url":"https://api.aiskills402.com/v1/skills/security-headers-writer/file","redownload_url_template":"https://api.aiskills402.com/v1/purchases/{token}","mcp_tool":null,"payment":{"protocol":"x402","scheme":"exact","asset":"USDC","selling":true,"network":"base","network_caip2":"eip155:8453","pay_to":"0xbc0dcc70d8b5d85541d86ffc68d988fd59c22e68","facilitator":"cdp"},"seo_title":"Security Headers: HSTS, CSP, Frames","seo_description":"Writes HSTS, framing, nosniff and a safe CSP for nginx, Netlify, Next.js or Cloudflare without breaking the page. Costs $0.02, a single payment.","versions":[{"version":"1.0.2","date":"2026-11-08","changelog":"# Changelog\n\n## 1.0.2 — 2026-11-08\n\nOnly the test summary text changed (the reason for the missing test run is no longer stated). The file itself is identical to 1.0.1.\n\n## 1.0.1 — 2026-11-08\n\nOne phrase of the instructions reworded (the Report-Only line about style sources), so that no free article repeats the paid wording. Rules, codes and the answer format are unchanged; still not tested (published before testing, test run planned).\n\n## 1.0.0 — 2026-11-07\n\nFirst release. Published 8.11.2026 before testing; test run planned (no measured benefit is claimed). Ordered by the site checker for three of its report lines: missing security headers, no or short Strict-Transport-Security, and a server version in a response header. The idea is ours; no foreign skill was opened, facts come from the public documentation of each host and header (see notes/ideas.md). Output: one line per finding with a fixed code, a Headers block in the host's own format, one Verify line, or exactly `No findings.`\n\nPrice 20000 ($0.02), chosen by the owner's range of 1 to 3 cents. The FAQ entry \"Does it help Claude Sonnet?\" says it is not measured yet.\n"},{"version":"1.0.1","date":"2026-11-08","changelog":"# Changelog\n\n## 1.0.1 — 2026-11-08\n\nOne phrase of the instructions reworded (the Report-Only line about style sources), so that no free article repeats the paid wording. Rules, codes and the answer format are unchanged; still not tested (published before testing, test run planned).\n\n## 1.0.0 — 2026-11-07\n\nFirst release. Published 8.11.2026 before testing; test run planned (no measured benefit is claimed). Ordered by the site checker for three of its report lines: missing security headers, no or short Strict-Transport-Security, and a server version in a response header. The idea is ours; no foreign skill was opened, facts come from the public documentation of each host and header (see notes/ideas.md). Output: one line per finding with a fixed code, a Headers block in the host's own format, one Verify line, or exactly `No findings.`\n\nPrice 20000 ($0.02), chosen by the owner's range of 1 to 3 cents. The FAQ entry \"Does it help Claude Sonnet?\" says it is not measured yet.\n"},{"version":"1.0.0","date":"2026-11-08","changelog":"# Changelog\n\n## 1.0.0 — 2026-11-07\n\nFirst release. Published 8.11.2026 before testing; test run planned (no measured benefit is claimed). Ordered by the site checker for three of its report lines: missing security headers, no or short Strict-Transport-Security, and a server version in a response header. The idea is ours; no foreign skill was opened, facts come from the public documentation of each host and header (see notes/ideas.md). Output: one line per finding with a fixed code, a Headers block in the host's own format, one Verify line, or exactly `No findings.`\n\nPrice 20000 ($0.02), chosen by the owner's range of 1 to 3 cents. The FAQ entry \"Does it help Claude Sonnet?\" says it is not measured yet.\n"}]}