# Security Headers Writer: HSTS, CSP, Frames Security Headers Writer: HSTS, CSP, Frames is a SKILL.md that writes the response headers a site is missing, in the format of the person's own host, and keeps the page working; an agent buys it once for $0.02 over x402. - Page: https://aiskills402.com/skills/security-headers-writer - Category: Code & Engineering (https://aiskills402.com/categories/code) - Price: $0.02 once, USD-priced, paid in USDC on Base over x402. Price as loaded on this page. The 402 response your agent receives is authoritative. - Version: 1.0.2 - Card (JSON): https://api.aiskills402.com/v1/skills/security-headers-writer ## Use it when Writes the response headers a site is missing, in the format of the person's own host, and keeps the page working. It reads the report line, the current response headers, the file that sets headers and the served head, and gives one line per finding with a fixed code, then a Headers block and a Verify line. It covers a missing or short Strict-Transport-Security, no framing rule, no nosniff, no enforcing Content-Security-Policy (a Report-Only header does not count) and a server version in a header. It enforces only directives that cannot break rendering; script, style, image, font and connect sources go into a Report-Only header built from the origins in the pasted head. It leaves out safe look-alikes: unsafe-inline in style-src only, a long max-age without preload, SAMEORIGIN, a Server header with no number and a missing Referrer-Policy. Exactly No findings. when all is well. Use when a site check reports missing security headers, no HSTS, a short HSTS max-age or a version number in a response header. ## Not for Reviewing a Content-Security-Policy that is already written, cookie flags, http addresses inside the markup, and hosts or servers not named in the skill, which get headers in the same shape marked unchecked. It reads the pasted headers, files and head; it does not request your site. A Report-Only policy needs the served head, and promoting it is your step. ## Not tested yet Published 2026-11-08 before its test run. No gain is claimed; the comparison with and without the skill is planned. ## What is in the file - The answer - Where the headers come from - What is NOT a finding - The codes - The Content-Security-Policy rule - The other headers - What each host documents - Rules - Work in this order - Short example ## Languages English ## How to buy Agent (HTTP): 1. GET https://api.aiskills402.com/v1/skills/security-headers-writer/file without a payment header. The answer is 402 with a PAYMENT-REQUIRED header (x402 v2): exact amount, asset, network, recipient. 2. Sign `accepts[0]` with an x402 client (for example @x402/core + @x402/evm). 3. Repeat the GET with the signature in the PAYMENT-SIGNATURE header. The answer is 200 with the file, its sha256 and a re-download token. Agent (MCP): https://mcp.aiskills402.com/mcp — free tools search_skills, get_skill, redownload_skill. Buying itself is over HTTP. Full flow: https://aiskills402.com/docs ## The file - Version: 1.0.2 - Size: 21.4 KB (21919 bytes) - SHA-256: e25047f91e8f1b694f4b2ab0f32da1d8b4dc754e308410bcf0c845112752b9e5 - Updated: 2026-11-08 - New versions are free through your re-download token. ## Versions ### 1.0.2 (2026-11-08) Only the test summary text changed (the reason for the missing test run is no longer stated). The file itself is identical to 1.0.1. ### 1.0.1 (2026-11-08) One phrase of the instructions reworded (the Report-Only line about style sources), so that no free article repeats the paid wording. Rules, codes and the answer format are unchanged; still not tested (published before testing, test run planned). ### 1.0.0 (2026-11-08) First release. Published 8.11.2026 before testing; test run planned (no measured benefit is claimed). Ordered by the site checker for three of its report lines: missing security headers, no or short Strict-Transport-Security, and a server version in a response header. The idea is ours; no foreign skill was opened, facts come from the public documentation of each host and header (see notes/ideas.md). Output: one line per finding with a fixed code, a Headers block in the host's own format, one Verify line, or exactly `No findings.` Price 20000 ($0.02), chosen by the owner's range of 1 to 3 cents. The FAQ entry "Does it help Claude Sonnet?" says it is not measured yet. ## License Perpetual, non-exclusive; use and modify for yourself incl. paid work; no resale or republishing. Holder: Georgi Kalchev, aiskills402.com. Terms: https://aiskills402.com/docs#license ## FAQ ### Which five findings does the answer report? A missing or short HSTS header, no framing rule, no nosniff, no enforcing Content-Security-Policy (a Report-Only header does not count and the line says so), and a version number in a response header. The answer then gives one Headers block in your host's own format and a Verify line that checks the home page and one deep page, with the https redirect first when HSTS is involved. ### How does it keep the page working after the headers go live? A policy that lists only your own origin for scripts stops inline framework scripts, font hosts and analytics the moment it is enforced, and the page looks broken. The enforcing header carries only framing, plugin and base rules; the script, style, image, font and connect sources go into a Report-Only header built from the origins in your pasted head, and you promote them after reading the reports. HSTS gets no subdomain rule when a plain-http subdomain exists. ### Does it help Claude Sonnet? Nobody can say yet. This file was listed before any model was tried on it, so there is no measured gain for Sonnet or Haiku to quote. Runs with and without the file are scheduled for the next weekly usage window, and the page will report what they show, including the case where they show nothing. ### What does a correct setup return? The reply is the fixed line No findings. and nothing else. A long max-age without preload, SAMEORIGIN with no frame-ancestors, unsafe-inline in style-src only, a Server header with no number and a missing Referrer-Policy earn no line and no remark. ## Related skills - [CSP Header Review](https://aiskills402.com/skills/csp-header-review.md): $0.01 once - [Cookie Attributes Review](https://aiskills402.com/skills/cookie-attributes-review.md): $0.01 once - [Cloudflare Workers Review: D1, OpenNext, Fetch](https://aiskills402.com/skills/workers-pitfalls-review.md): $0.05 once - [Soft 404 Fix](https://aiskills402.com/skills/soft-404-fix.md): $0.01 once ## Measurement limits - Models other than the two named above were not run. - Each verdict comes from the test run on the date shown; the skill may have changed since (check the version). - Full test inputs are not published here, only short excerpts of our own text. - Results on your own texts, languages and domains can differ. Offer note: Paid in USDC (USD-pegged) over x402 by an AI agent; one-time.