security-headers-configuration

HTTP security headers mitigate XSS, clickjacking, and MIME-sniffing by instructing browsers to enforce strict policies. This Skill configures essential headers—HSTS, CSP, X-Frame-Options, and X-Content-Type-Options—across Express, Nginx, Flask, and Apache to harden your application and pass security audits.

Security headers require platform-specific implementation. This Skill provides per-platform provisioning: helmet for Express, headers directives for Nginx, Flask-Talisman for Python Flask, and mod_headers for Apache, ensuring consistent hardening across your deployment.

CSP is a security header that restricts resource loading to prevent XSS attacks. Nonce-based CSP uses unique tokens to allow specific inline scripts and styles while blocking unauthorized code, providing fine-grained control without broad inline permissions.

Verification tools scan HTTP response headers to confirm HSTS, CSP, X-Frame-Options, and other security directives are present and properly set. This Skill includes tooling and best practices to test and validate header configuration across your application.

Yes. Referrer-Policy controls leak of referrer information, and Permissions-Policy restricts browser features like geolocation and camera. This Skill covers both as part of comprehensive hardening and audit-ready security header implementation.

HTTP Strict-Transport-Security (HSTS) forces browsers to communicate over HTTPS only, preventing downgrade attacks and man-in-the-middle interception. This Skill configures HSTS across all supported platforms to enforce secure transport.