Agent skill · security · aj-geddes
security-headers-configuration
Configure HTTP security headers including CSP, HSTS, X-Frame-Options, and XSS protection. Use when hardening web applications against common attacks.
Why this skill is useful
Provides specific implementation patterns and configuration examples for HTTP security headers that the AI wouldn't reliably generate on its own.
What it needs
Requires helmet installed locally. About 1k tokens when loaded. Last updated 2026-03-04. 307 stars on the source repository.
What this skill does
Security Headers Configuration Table of Contents Overview When to Use Quick Start Reference Guides Best Practices Overview Implement comprehensive HTTP security headers to protect web applications from XSS, clickjacking, MIME sniffing, and other browser-based attacks. When to Use New web application deployment Security audit remediation Compliance requirements Browser security hardening API security Static site protection Quick Start Minimal working example: Reference Guides Detailed implementations in the references/ directory: Guide Contents --- --- Node.js/Express Security Headers Node.js/Express Security Headers Nginx Security Headers Configuration Nginx Security Headers Configuration Python Flask Security Headers Python Flask Security Headers Apache .htaccess Configuration Apache .htaccess Configuration Security Headers Testing Script Security Headers Testing Script Best Practices ✅ DO Use HTTPS everywhere Implement strict CSP Enable HSTS with preload Block framing with X-Frame-Options Prevent MIME sniffing Report CSP violations Test headers regularly Use security scanners ❌ DON'T Allow unsafe-inline in CSP Skip HSTS on subdomains Ignore CSP violations Use overly permissive policies Forget to test changes
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aj-geddes/security-headers-configuration