Speedrunlab

Website Security Skill — Security skill for Claude Code

Security community

Website Security Skill: your agent walks you through securing your own website, one step at a time, and checks each step worked.

How to install Website Security Skill

This entry records only its repository, not the path inside it, so there is no exact command to give. Open Speedrunlab/website-security-skill and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Website Security Skill does

Website Security Skill: your agent walks you through securing your own website, one step at a time, and checks each step worked. Backups, DNS, email authentication, Cloudflare, updates, safe plugins. Agent-agnostic. MIT.

Alternatives in Security

Security Scan Report — Generated: 2026-04-10 20:48 UTC Skills scanned: 134 Total findings: 836 Critical: 32 High: 50 Safe skills: 100 18.1k ★
Curate Security Results — Run Security Tests & Curate Results — Public-Safe Snapshots 295 ★
Postgres — Execute safe read-only SQL queries against PostgreSQL databases with multi-connection support and defense-in-d 159 ★

README

website-security-skill

**Website Security Skill: your agent walks you through securing your own website, one step at a time, in plain English, and checks each step worked before moving on.**

Free and open source · MIT Licence · Built by [Speedrun AI Labs](https://www.speedrunlab.ai), Sydney, Australia

The problem

Most small-business websites are set up once and left alone. The server's address is public, the only backup is the host's, the contact form sends mail that receivers can't verify, and a cheap "nulled" plugin is one click away. The fixes are well known, but they come as long lists, in the wrong order, with no way to tell whether each one actually worked.

Ask a capable agent for help and you get the same list: every step at once, five questions in one message, brand recommendations, and figures with no source. For someone who isn't technical, that is a wall, not a walkthrough.

What it does

The skill turns your agent into a patient guide. It maps your setup first (where the domain, DNS, hosting and email live), then takes you through eight steps in a safe order. Each step is one message: what it does, why it matters, at most three things for you to do, then a check that it worked.

Back up the site yourself, and test a restore. Your own copies, one of them away from the host, and a restore that has actually worked.
Keep your own copy of the DNS records. An export you can put back after a mistake or a move.
Send the site's email through a proper email service. SPF, DKIM and DMARC set up and proven with a test message, and the message's headers checked for the server's address.
Put the domain on Cloudflare, and keep the server's address private. The proxy on, encryption at Full (strict), and every leak closed: DNS-only records, SPF entries, old DNS history, and a server that still answers anyone who knows its address.
Keep the proxy on from day one, and use what it gives you. The free managed rules, a consi