security-headers-audit

Audit HTTP security header misconfigurations across Express, Nginx, Apache, Next.js, Flask, Django, and Spring Boot.

1|Updated Mar 25, 2026

Search Tags:#csp #web-security #cors #https #hsts #security-headers

Ready to run

npx skills add https://github.com/kalshamsi/claude-security-skills --skill security-headers-audit

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-headers-audit
Source: https://github.com/kalshamsi/claude-security-skills/tree/main/skills/security-headers-audit
Command: npx skills add https://github.com/kalshamsi/claude-security-skills --skill security-headers-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

A single misconfigured security header can weaken a web application's defenses against cross-site scripting, clickjacking, MIME sniffing, and cross-origin data leakage. This skill helps identify and remediate these header misconfigurations across popular frameworks and server configurations.

Core Features & Use Cases

Detects missing or misconfigured headers such as Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, HSTS, and CORS across Express, Nginx, Apache, Next.js, Flask, Django, and Spring Boot.
Maps findings to CWE and OWASP Top 10:2021 to prioritize remediation.
Provides framework-specific remediation guidance and example configurations to harden security posture.

Quick Start

Run the security-headers-audit skill against your project to generate a prioritized report of header issues and fixes.

Frequently Asked Questions about security-headers-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit HTTP security headers across multiple web frameworks?▼

Auditing HTTP security headers involves validating the presence and values of CSP, CORS, HSTS, and X-Frame-Options across frameworks like Express, Nginx, Apache, Next.js, Flask, Django, and Spring Boot to identify misconfigurations and provide remediation guidance.

What HTTP security headers are required to prevent XSS and clickjacking?▼

Required HTTP security headers include Content-Security-Policy to mitigate cross-site scripting, X-Frame-Options to prevent clickjacking, X-Content-Type-Options to stop MIME sniffing, and HSTS to enforce secure connections.

How do I fix CORS misconfigurations in Express and Django applications?▼

Fixing CORS misconfigurations in Express and Django requires validating cross-origin resource sharing policies against secure baselines, mapping findings to CWE and OWASP Top 10:2021 categories, and applying framework-specific remediation guidance.

Does the security header audit map findings to OWASP Top 10:2021 vulnerabilities?▼

Yes, the security header audit maps misconfiguration findings to CWE and OWASP Top 10:2021 categories to prioritize remediation efforts and harden web applications against cross-origin data leakage and related attacks.

Can I use this audit to harden HSTS and Referrer-Policy in Next.js and Nginx?▼

Yes, you can use this audit to harden HSTS and Referrer-Policy configurations in Next.js and Nginx by validating header values and generating framework-specific example configurations to improve your security posture.

Why does my web application still show missing X-Content-Type-Options after configuration?▼

Missing X-Content-Type-Options after configuration typically indicates a misconfiguration or override in your server setup, requiring a validation audit to detect the exact discrepancy and generate framework-specific remediation guidance.