static-site-security

Apply security best practices to static websites hosted on GitHub Pages.

9|3|Updated Jun 4, 2022

Search Tags:#audit #csp #web-security #headers #https #github-pages #static-site-security

Ready to run

npx skills add https://github.com/Hack23/riksdagsmonitor --skill static-site-security

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: static-site-security
Source: https://github.com/Hack23/riksdagsmonitor/tree/main/.github/skills/static-site-security
Command: npx skills add https://github.com/Hack23/riksdagsmonitor --skill static-site-security

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Static sites on GitHub Pages often ship with insecure defaults or misconfigurations. This Skill provides a comprehensive, battle-tested checklist and implementation guidance to harden static sites without server-side logic.

Core Features & Use Cases

HTTPS enforcement and automatic TLS
Security headers (CSP, HSTS, etc.)
Content Security Policy and Subresource Integrity guidance
Dependency hygiene and minimal external dependencies
DNS, hosting, and GitHub Pages security configurations
Incident response, monitoring, and audit readiness

Quick Start

Follow these steps to audit and apply the core security settings to your GitHub Pages site.

Frequently Asked Questions about static-site-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I add security headers to a static site on GitHub Pages?▼

Content Security Policy and other security headers are configured for GitHub Pages using a checklist-based deployment workflow. This process provides guidance for adding CSP, HSTS, and headers without requiring server-side logic.

How do I enforce HTTPS and automatic TLS for GitHub Pages?▼

HTTPS enforcement and automatic TLS are applied through specific DNS and GitHub Pages security configurations. This ensures your static website strictly uses encrypted connections and resolves insecure default settings.

What is the best way to audit dependencies for a static website?▼

Auditing dependencies for a static website involves evaluating dependency hygiene and minimizing external resources. This checklist-based approach guides you through dependency management to ensure minimal and secure external integrations.

Does GitHub Pages support Content Security Policy and Subresource Integrity?▼

Yes, GitHub Pages static sites can implement Content Security Policy and Subresource Integrity. The Skill provides specific guidance for configuring CSP and SRI to prevent cross-site scripting and ensure external resources have not been tampered with.

Can I set up incident response and monitoring for a static site?▼

Incident response and monitoring for static sites are configured by following a comprehensive security checklist. This prepares your static website for audit readiness and helps manage security incidents without server-side monitoring logic.