Guide · Agent skill
How to use the HSTS Header Checker agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
The HSTS Header Checker is an agent skill, a packaged set of instructions that an AI coding agent such as Claude can load and follow. It checks whether a website sends the Strict-Transport-Security header on its HTTPS responses and whether the max-age, includeSubDomains and preload settings are sensible. After this guide you will know how to install the skill, how to ask for a check in plain language, and what the results mean.
HSTS Header Checkerthedaviddias/Front-End-Checklist · MIT Download the skill Quick start
- 1Download the skill. Download the ZIP from this skill's page and unzip it on your computer.
- 2Place the folder. Move the unzipped skill folder into ~/.claude/skills/ for personal use, or into .claude/skills/ inside a project.
- 3Or upload it in the Claude apps. If you use the Claude apps, go to Settings → Capabilities → Skills and upload the skill.
- 4Ask for a check in plain language. Name the site or paste its response headers and ask whether HSTS is set correctly.
- 5Review max-age, includeSubDomains and preload. Compare the agent's findings with the guidance: at least one year, includeSubDomains only when all subdomains use HTTPS, and preload only after testing.
- 6Make changes and verify. Update your web server or CDN yourself, then confirm the header on live HTTPS responses, for example with curl or securityheaders.com.
What the HSTS skill makes the agent do
HSTS (HTTP Strict Transport Security) tells browsers to always use HTTPS for a domain, even if someone types an http:// address or clicks an unencrypted link. Without it, an attacker on the same network can intercept the first HTTP request and strip TLS (SSL stripping), downgrading the connection before the browser sees any redirect.
When this skill is installed, the agent reviews HTTP response headers on a site served over HTTPS. It checks that the header is present on all HTTPS responses and that max-age, includeSubDomains and preload are appropriate. It then explains what it found and can suggest the header to add and how to configure a web server or CDN to send it.
- Checks whether Strict-Transport-Security is sent on HTTPS responses
- Reviews max-age, includeSubDomains and preload values
- Explains what HSTS does and why it matters
- Suggests the header to add and where to configure it on a web server or CDN
Strict-Transport-Security: max-age=31536000; includeSubDomainsInstall the HSTS skill in Claude
Download the skill ZIP from the skill's page in this directory and unzip it. Then place the unzipped skill folder in one of two locations: your personal skills folder at ~/.claude/skills/ so it is available in every project, or a project-specific .claude/skills/ folder inside the project you are working on.
If you use the Claude apps instead of a local folder, you can upload the skill under Settings → Capabilities → Skills.
- Personal install: ~/.claude/skills/
- Project install: .claude/skills/ inside your project
- Claude apps: Settings → Capabilities → Skills, then upload the skill
Trigger the skill with natural requests
You do not need a special command. The skill is meant to be used when you review HTTP response headers on a site that serves content over HTTPS, so describe that task in ordinary words. Give the agent the site or the response headers you want reviewed, and say what you want: a check, an audit, or an explanation.
Be specific about the domain. The agent can only judge what it is shown, so include the address of the site or paste the response headers.
- 'Check whether example.com sends an HSTS header on its HTTPS responses.'
- 'Review the Strict-Transport-Security settings in these response headers and tell me if max-age is sensible.'
- 'Should I add includeSubDomains to our HSTS header? Our subdomains are all on HTTPS.'
- 'Explain how HSTS prevents SSL stripping, then suggest a header for our site.'
Read the results and act on them carefully
The source recommends a max-age of 31536000 (one year) at minimum, and includeSubDomains to protect subdomains from downgrade attacks. Preload needs more care: the source says to add it only after testing, because it is difficult to reverse and takes weeks to propagate. Never send the header over plain HTTP, only over HTTPS.
The source also suggests validating a header after you set it, using curl or securityheaders.com. The skill itself does not run these checks, so treat the agent's output as guidance and verify the live response yourself.
- Use max-age=31536000 as the minimum
- Add includeSubDomains only when every subdomain is fully on HTTPS
- Add preload only after testing
- Send the header only over HTTPS
Safety notes: scripts, network and server changes
The skill requires nothing beyond the agent itself. It does not run scripts and does not use the network, and its files describe guidance only. It will not change your server configuration for you; any change to your web server or CDN is something you make yourself.
Before you enable HSTS, make sure the site works fully over HTTPS. Enabling it, especially with includeSubDomains or preload, can make subdomains or the whole site unreachable until HTTPS works everywhere.
- No scripts run and no network use
- Server and CDN changes are made by you, not by the skill
- Do not enable HSTS on a site that is not yet fully served over HTTPS
Tips for a useful review
The skill covers one header only. For a full security audit you will need to review other headers and settings separately. The source's reference file, references/rule.md, gives more detail on the directives and implementation, and the skill's SKILL.md describes the Check, Fix and Explain steps the agent follows.
Ask the agent to explain its reasoning. If you are learning HSTS, ask why each directive is recommended, not just what value to use.
- Use the skill for HSTS only; run other checks for the rest of your headers
- Read references/rule.md for implementation detail
- Ask for explanations to learn why each setting matters
What people use it for
- Checking whether a company website sends HSTS on all HTTPS pages before a security review
- Deciding whether includeSubDomains is safe for a domain with many subdomains
- Learning why HSTS prevents SSL stripping, for a team onboarding document
- Drafting the Strict-Transport-Security line to add to a web server or CDN configuration
Frequently asked questions
Is the HSTS Header Checker skill free?
The skill is published under the MIT licence, as listed on its page. Check the licence file in the source repository for the full terms.
What do I need to use the HSTS skill?
The skill lists no specific requirements. It does not run scripts and does not use the network, so you need an agent that can load skills, such as Claude with the skill installed.
Where do I install an agent skill?
Unzip the downloaded skill into ~/.claude/skills/ for personal use or into .claude/skills/ inside a project. In the Claude apps, you can upload it under Settings → Capabilities → Skills.
Will the skill change my server settings automatically?
No. The skill gives guidance only and does not configure servers. You need to add the header to your web server or CDN yourself.
What should max-age be for HSTS?
The source recommends max-age=31536000, which is one year, as a minimum. Shorter values give a weaker policy.
Is it safe to add preload to HSTS?
Only after testing. The source says preload is difficult to reverse and takes weeks to propagate, so enable it only when you are confident the whole site works over HTTPS.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
This skill suits developers, site owners and security reviewers who want clear, correct guidance on the HSTS header. It is not suited to sites that are not yet fully on HTTPS, to anyone expecting automatic server changes, or to people who need a complete security audit of all headers.
Download the skill