Security Headers Configuration

This is your checklist for implementing HTTP security headers across Express, Nginx, Flask, and Apache. It covers the essentials like HSTS, CSP, X-Frame-Options, and X-Content-Type-Options with ready-to-use configurations. The Express section uses Helmet with customizable CSP directives, and the Nginx config includes all the modern headers you need. What I like is the included verification tools and the common mistakes section, because CSP is notorious for breaking things when you deploy without testing. Use this when you're hardening a web app for production, passing a security audit, or just trying to get an A rating on securityheaders.com.

skills.sh installs: 454
GitHub stars: 248
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add secondsky/claude-skills --skill security-headers-configuration --agent claude-code

Installs into .claude/skills of the current project.

Files

Security Headers Configuration

Implement HTTP security headers to defend against common browser-based attacks.

Essential Headers

Header	Purpose	Value
HSTS	Force HTTPS	`max-age=31536000; includeSubDomains`
CSP	Restrict resources	`default-src 'self'`
X-Frame-Options	Prevent clickjacking	`DENY`
X-Content-Type-Options	Prevent MIME sniffing	`nosniff`

Express Implementation

const helmet = require('helmet');

app.use(helmet());

// Custom CSP
app.use(helmet.contentSecurityPolicy({
  directives: {
    defaultSrc: ["'self'"],
    scriptSrc: ["'self'", "'unsafe-inline'"],
    styleSrc: ["'self'", "'unsafe-inline'"],
    imgSrc: ["'self'", "data:", "https:"],
    connectSrc: ["'self'", "https://api.example.com"],
    fontSrc: ["'self'", "https://fonts.gstatic.com"],
    frameAncestors: ["'none'"]
  }
}));