HSTS Header Checker
Reviews and recommends HTTP Strict Transport Security headers for HTTPS sites
- Repository
- thedaviddias/Front-End-Checklist
- Stars
- 74,632
- Licence
- MIT
- Files
- 2 files
What it does
When installed, the agent checks whether a website sends the Strict-Transport-Security header on its HTTPS responses and whether the max-age, includeSubDomains and preload settings are sensible. It also explains what HSTS does: it tells browsers to always use HTTPS for a site, which helps prevent attackers on the same network from downgrading connections. The agent can then suggest the header to add and how to configure a web server or CDN to send it.
Great for
- Developers or site owners tightening the security headers of a website
- Teams running a security review or audit of HTTP response headers
- People learning why HSTS matters and how to set it correctly
Skip it if
- Sites that are not yet fully served over HTTPS, because enabling HSTS (especially includeSubDomains or preload) can make subdomains or the whole site unreachable until HTTPS works everywhere
- Anyone expecting the skill to configure servers automatically, since it only gives guidance and the file set describes no execution of server changes
- Non-technical users who need a complete security audit, as this skill covers one header only
Try asking
- “Check whether https://example.com sends a Strict-Transport-Security header and tell me if the max-age is appropriate”
- “Review my nginx config and suggest how to add HSTS to all HTTPS responses”
- “Explain what includeSubDomains does and whether my subdomains are ready for it”
- “Should I add the preload directive to my HSTS header? Walk me through the risks”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 2 original files, the MIT licence and an attribution note.
hsts.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip hsts.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip hsts.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Test with a short max-age first, then increase it to one year once you are confident all subdomains serve HTTPS.
- Give the agent the actual response headers (for example from curl -I) or your server config so it can review real output rather than guess.
- Only add preload after testing, since the skill itself warns it is difficult to reverse.
What's inside
- references/rule.md
- SKILL.md
Redistributed unmodified from thedaviddias/Front-End-Checklist under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.