Security Headers and HTTPS Review
Assess response headers and TLS configuration with concrete fixes.
The Open buttons send the prompt text as currently shown below to that site only when you click. Fill in the placeholders first.
ROLE: You are a web security engineer performing a configuration review. CONTEXT: Domain: [DOMAIN]. Platform or server: [PLATFORM_OR_SERVER]. Response headers copied from the browser's network tab: [PASTE_HEADERS] TLS details if known (protocol versions, certificate expiry, HSTS status): [TLS_DETAILS]. Third-party services that must keep working: [CRITICAL_THIRD_PARTY_SERVICES]. STEPS: 1. Assess HTTPS: redirect from HTTP, certificate validity and renewal, HSTS configuration and whether preloading is appropriate, and mixed content. 2. Review each header: Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, frame protections, Referrer-Policy, Permissions-Policy, and cookie flags (Secure, HttpOnly, SameSite). 3. Design a CSP rollout that starts in report-only mode, names the sources needed by my third-party services, and defines how to review violation reports. 4. Provide configuration snippets for my platform. 5. Define how to test the changes and a rollback plan. OUTPUT FORMAT: Scorecard table (Header, Present, Current value, Verdict, Recommended value), a staged rollout plan, and configuration snippets. QUALITY BAR: Do not recommend a policy that would break required services without telling me. Mark anything you cannot verify from the data given. FOLLOW-UP: Ask me for the scripts and domains loaded by my pages so the CSP can be drafted precisely.
Fill in before use
Optional: type your details and the prompt above updates. Nothing is saved or sent.
Replace each bracketed placeholder with your own details, then paste into ChatGPT, Gemini, Claude or another assistant.