HTTP Security Header Audit

Checks a site's response headers against modern web-security best practices and returns prioritized findings with concrete fixes. The analysis core is pure and offline-testable; live scanning uses only Python's stdlib urllib.

When to use this skill

• "Audit the security headers on https://example.com."
• "Is my CSP / HSTS / cookie config correct?"
• "Why is this site flagged for missing headers?"

What it checks

• Content-Security-Policy — presence, unsafe-inline, wildcards.
• Strict-Transport-Security — presence and max-age length.
• X-Content-Type-Options: nosniff, X-Frame-Options / frame-ancestors.
• Referrer-Policy, Permissions-Policy.
• Information disclosure — Server / X-Powered-By version banners.
• Cookies — Secure, HttpOnly, SameSite (incl. SameSite=None without Secure).

How to run it

# Live scan
python skills/http-sec-audit/audit.py https://example.com

# JSON output
python skills/http-sec-audit/audit.py https://example.com --json

# Offline: audit a saved raw header block (no network)
python skills/http-sec-audit/audit.py --headers-file response_headers.txt

# Only fail CI on high/critical (a missing Permissions-Policy is LOW and
# shows up on almost every site)
python skills/http-sec-audit/audit.py https://example.com --min-severity high

# Also check cross-origin isolation (COOP/COEP/CORP) and Cache-Control.
# Off by default: most sites have good reasons not to set these, and a
# reported finding fails the run.
python skills/http-sec-audit/audit.py https://example.com --advisory

Exit codes: 0 clean · 1 findings reported · 2 fetch/usage error. Every reported finding fails the build; raise --min-severity to filter advisory findings out of both the report and the exit code.

Recommended workflow for Claude

1. Run the audit (live, or offline against captured headers).
2. Group findings by severity and present each with its one-line fix.
3. Offer ready-to-paste header snippets for the user's stack (nginx, Apache, Express, etc.) for the missing headers.
4. Only scan sites the user owns or is authorized to test.