Best Practices

A comprehensive reference for modern web security and quality standards that covers HTTPS enforcement, CSP configuration, security headers, and safe coding patterns. Use it when auditing code for vulnerabilities, modernizing legacy projects, or implementing proper error handling. The examples are practical, showing both wrong and right patterns for everything from XSS prevention to passive event listeners. It leans heavily on Lighthouse audit criteria, which makes sense since that's what clients and stakeholders often reference. The security headers section alone is worth having on hand. Could use more on accessibility best practices, but for security and compatibility checks, this hits the main concerns you'll face in production codebases.

skills.sh installs: 398
GitHub stars: 33.2K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add davila7/claude-code-templates --skill best-practices --agent claude-code

Installs into .claude/skills of the current project.

Files

Best practices

Modern web development standards based on Lighthouse best practices audits. Covers security, browser compatibility, and code quality patterns.

Security

HTTPS everywhere

Enforce HTTPS:

<!-- ❌ Mixed content -->
<img src="http://example.com/image.jpg">
<script src="http://cdn.example.com/script.js"></script>

<!-- ✅ HTTPS only -->
<img src="https://example.com/image.jpg">
<script src="https://cdn.example.com/script.js"></script>

<!-- ✅ Protocol-relative (will use page's protocol) -->
<img src="//example.com/image.jpg">

HSTS Header:

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

Content Security Policy (CSP)

<!-- Basic CSP via meta tag -->
<meta http-equiv="Content-Security-Policy" 
      content="default-src 'self'; 
               script-src 'self' https://trusted-cdn.com; 
               style-src 'self' 'unsafe-inline';
               img-src 'self' data: https:;
               connect-src 'self' https://api.example.com;">

<!-- Better: HTTP header -->

SKILL.md on GitHub