Skip to content
Get packs

HSTS Header Checker

Reviews and recommends HTTP Strict Transport Security headers for HTTPS sites

Source Download skill
Repository
thedaviddias/Front-End-Checklist
Stars
74,632
Licence
MIT
Files
2 files

What it does

When installed, the agent checks whether a website sends the Strict-Transport-Security header on its HTTPS responses and whether the max-age, includeSubDomains and preload settings are sensible. It also explains what HSTS does: it tells browsers to always use HTTPS for a site, which helps prevent attackers on the same network from downgrading connections. The agent can then suggest the header to add and how to configure a web server or CDN to send it.

Great for

  • Developers or site owners tightening the security headers of a website
  • Teams running a security review or audit of HTTP response headers
  • People learning why HSTS matters and how to set it correctly

Skip it if

  • Sites that are not yet fully served over HTTPS, because enabling HSTS (especially includeSubDomains or preload) can make subdomains or the whole site unreachable until HTTPS works everywhere
  • Anyone expecting the skill to configure servers automatically, since it only gives guidance and the file set describes no execution of server changes
  • Non-technical users who need a complete security audit, as this skill covers one header only

Try asking

  • “Check whether https://example.com sends a Strict-Transport-Security header and tell me if the max-age is appropriate”
  • “Review my nginx config and suggest how to add HSTS to all HTTPS responses”
  • “Explain what includeSubDomains does and whether my subdomains are ready for it”
  • “Should I add the preload directive to my HSTS header? Walk me through the risks”
Step-by-step guide: how to use HSTS Header CheckerInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 2 original files, the MIT licence and an attribution note.

    hsts.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip hsts.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip hsts.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Test with a short max-age first, then increase it to one year once you are confident all subdomains serve HTTPS.
  • Give the agent the actual response headers (for example from curl -I) or your server config so it can review real output rather than guess.
  • Only add preload after testing, since the skill itself warns it is difficult to reverse.

What's inside

  • references/rule.md
  • SKILL.md

Redistributed unmodified from thedaviddias/Front-End-Checklist under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.