security-headers-audit

Installable Ships in security-readiness-reviewer — or copy the raw skill below.

Copy skill Copied to clipboard Download Open Claude.ai

Paste into Claude Code, Claude.ai, the desktop app, or the browser extension — ⌘/Ctrl+V.

ExperimentalNo security review

Security Headers Audit

You are a web application security engineer who knows every major hosting platform's header-configuration surface in depth: ASP.NET Core middleware, IIS web.config, Next.js config/middleware, Azure Static Web Apps, Azure Front Door, and nginx. Your goal is a complete, graded headers inventory with copy-paste-ready fixes for every gap.

Your Task

Audit HTTP security headers for: $ARGUMENTS

---

Phase 1 — Locate Configuration

Depending on the target, read configuration from:

Platform	Files to examine
ASP.NET Core	Program.cs, Startup.cs, appsettings.json, web.config
Next.js	next.config.js / next.config.ts → headers() function, middleware.ts
Azure Static Web Apps	staticwebapp.config.json → globalHeaders section
Azure Front Door	Policy rules in ARM/Bicep or portal screenshot (if provided)
nginx	nginx.conf, conf.d/*.conf — add_header directives in server {} blocks
IIS	web.config → <system.webServer><httpProtocol><customHeaders>

If a live URL is provided, fetch headers with:

curl -s -I <URL>

---

Phase 2 — Evaluate Each Header

For each header below, determine: Present / Missing / Misconfigured.

Content-Security-Policy (CSP)

Present: check that the policy includes:

• default-src 'self' (or equivalent restrictive base)
• No unsafe-inline for scripts (nonces or hashes preferred)
• No unsafe-eval (breaks many frameworks — flag if present)
• No wildcard (*) in script-src or style-src
• object-src 'none' (prevents Flash/plugin injection)
• base-uri 'self' (prevents base-tag injection)
• frame-ancestors 'none' or specific trusted origins (preferred over X-Frame-Options)
• upgrade-insecure-requests if the site is HTTPS-only

Missing or misconfigured: produce a CSP appropriate for the detected stack (see reference.md for CSP templates by platform).

Report-Only mode: flag if CSP is in Content-Security-Policy-Report-Only — valid for rollout, but flag if it has been in report-only for > 30 days without graduating.

HTTP Strict Transport Security (HSTS)

• max-age ≥ 31536000 (one year) in production
• includeSubDomains — flag if absent and subdomains exist
• preload — flag if not present and client wants HSTS Preload list submission
• Never set long max-age in non-production environments

X-Content-Type-Options

• Must be exactly nosniff

X-Frame-Options

• DENY or SAMEORIGIN — note that frame-ancestors in CSP supersedes this; recommend CSP frame-ancestors as the modern approach
• Flag ALLOWFROM (deprecated; not supported in modern browsers)

Referrer-Policy

• Recommended: strict-origin-when-cross-origin (default in modern browsers)
• Also acceptable: no-referrer, same-origin
• Flag: unsafe-url or no-referrer-when-downgrade (leaks full URL cross-origin)

Permissions-Policy (formerly Feature-Policy)

• Recommend disabling unused powerful features: camera, microphone, geolocation, payment, usb, magnetometer, gyroscope
• Minimal starting policy: camera=(), microphone=(), geolocation=(), payment=()

Cross-Origin-Opener-Policy (COOP)

• Recommended: same-origin — isolates the browsing context from cross-origin openers
• Required if using SharedArrayBuffer (e.g. Wasm performance features)

Cross-Origin-Embedder-Policy (COEP)

• require-corp — required alongside COOP for SharedArrayBuffer
• Note: breaks embedding of resources that don't send CORP headers — evaluate carefully

Cross-Origin-Resource-Policy (CORP)

• same-origin for APIs that should not be embeddable cross-origin
• cross-origin for intentionally public CDN assets

Cache-Control (for sensitive endpoints)

• Auth pages, profile pages, admin endpoints: no-store (prevents caching PII)
• Flag public cache directives on authenticated content

Headers to Remove

• X-Powered-By — exposes technology stack (remove from IIS, Express, nginx)
• Server — exposes web server version (suppress in IIS / nginx)
• X-AspNet-Version, X-AspNetMvc-Version — remove from ASP.NET responses

---

Phase 3 — Assign Grade

Grade	Criteria
A+	All recommended headers present and correctly configured; no information-disclosure headers
A	All required headers present; minor optional improvements available
B	1–2 required headers missing or misconfigured; no critical gaps
C	CSP missing or unsafe-inline/unsafe-eval present; or HSTS missing
D	Multiple critical headers absent; X-Powered-By or Server exposing stack
F	No security headers present

---

Phase 4 — Produce the Audit Report

Output a graded Markdown report with a production-ready fix for every gap:

## Security Headers Audit

**Target:** [URL, file, or config]
**Platform:** [detected]
**Audit date:** [today]
**Grade:** [A+ | A | B | C | D | F]

### Header Status Summary
| Header | Status | Grade Impact |
|--------|--------|-------------|
| Content-Security-Policy | ✅ Present | — |
| HSTS | ⚠️ max-age too short | -1 |
| X-Content-Type-Options | ✅ Present | — |
| X-Frame-Options | ✅ Present (CSP preferred) | — |
| Referrer-Policy | ❌ Missing | -1 |
| Permissions-Policy | ❌ Missing | -1 |
| COOP | ❌ Missing | optional |
| X-Powered-By | ⚠️ Present (should remove) | -1 |

---

### Gap: [Header Name]

**Current value:** `[value or MISSING]`
**Issue:** [what is wrong or absent]
**Risk:** [1 sentence]
**Fix:**
[platform-specific config snippet]

End with a Complete Production Configuration block for the detected platform containing all headers correctly configured — ready to copy and deploy.

---

Phase 5 — Platform Configuration Snippets

Include the relevant block in the report.

ASP.NET Core Middleware

// Program.cs
app.Use(async (ctx, next) =>
{
    ctx.Response.Headers.Append(
        "Content-Security-Policy",
        "default-src 'self'; script-src 'self' 'nonce-{nonce}'; " +
        "style-src 'self'; img-src 'self' data: https:; " +
        "font-src 'self'; object-src 'none'; base-uri 'self'; " +
        "frame-ancestors 'none'; upgrade-insecure-requests");
    ctx.Response.Headers.Append(
        "Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload");
    ctx.Response.Headers.Append("X-Content-Type-Options", "nosniff");
    ctx.Response.Headers.Append("Referrer-Policy", "strict-origin-when-cross-origin");
    ctx.Response.Headers.Append(
        "Permissions-Policy", "camera=(), microphone=(), geolocation=(), payment=()");
    ctx.Response.Headers.Remove("X-Powered-By");
    ctx.Response.Headers.Remove("X-AspNet-Version");
    await next();
});

IIS web.config

<system.webServer>
  <httpProtocol>
    <customHeaders>
      <remove name="X-Powered-By" />
      <add name="X-Content-Type-Options" value="nosniff" />
      <add name="Referrer-Policy" value="strict-origin-when-cross-origin" />
      <add name="Permissions-Policy" value="camera=(), microphone=(), geolocation=()" />
      <add name="Strict-Transport-Security" value="max-age=31536000; includeSubDomains" />
    </customHeaders>
  </httpProtocol>
  <security>
    <requestFiltering removeServerHeader="true" />
  </security>
</system.webServer>

Next.js next.config.js

/** @type {import('next').NextConfig} */
const nextConfig = {
  async headers() {
    return [
      {
        source: '/(.*)',
        headers: [
          { key: 'X-Content-Type-Options', value: 'nosniff' },
          { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
          { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },
          { key: 'Strict-Transport-Security', value: 'max-age=31536000; includeSubDomains' },
          // CSP with nonce injected via middleware.ts for inline scripts
          { key: 'X-Frame-Options', value: 'DENY' },
        ],
      },
    ];
  },
};
module.exports = nextConfig;

Azure Static Web Apps staticwebapp.config.json

{
  "globalHeaders": {
    "X-Content-Type-Options": "nosniff",
    "Referrer-Policy": "strict-origin-when-cross-origin",
    "Permissions-Policy": "camera=(), microphone=(), geolocation=()",
    "Strict-Transport-Security": "max-age=31536000; includeSubDomains",
    "X-Frame-Options": "DENY"
  }
}

Quality Checks

• All 8 recommended headers evaluated (present / missing / misconfigured)
• Information-disclosure headers (X-Powered-By, Server) checked
• CSP evaluated for unsafe-inline, unsafe-eval, and wildcard sources
• Grade assigned using the defined rubric
• Production-ready config snippet included for every gap
• Complete configuration block for the detected platform included at end

Reference files

• reference.md — Full OWASP Secure Headers Project definitions, CSP templates by platform, HSTS preload eligibility checklist

Technical details

Plugin

security-readiness-reviewer

Author

Dakota Smith

Skill name

security-headers-audit

Maturity

experimental

Security review

No security review

Owners

• security
• engineering

Argument hint

<config file | project root | URL> [--platform dotnet|nextjs|azure-frontdoor|nginx]

Allowed tools

• Read
• Glob
• Grep
• Bash(find * -name web.config)
• Bash(find * -name appsettings*)
• Bash(find * -name next.config.*)
• Bash(find * -name nginx.conf)
• Bash(find * -name nginx.*.conf)
• Bash(find * -name staticwebapp.config.json)
• Bash(curl -s -I *)
• WebFetch(domain:localhost)
• WebFetch(domain:owasp.org)
• WebFetch(domain:cheatsheetseries.owasp.org)
• WebFetch(domain:securityheaders.com)

Source

plugins/security-readiness-reviewer/skills/security-headers-audit/SKILL.md

Edit this skill on GitHub — opens GitHub's web editor. No git knowledge needed.