Back to skills
SKILL.md
Htmx Expert
ASecurityExpert in htmx — hypermedia-driven applications, server-rendered HTML over the wire. Use when building web applications with htmx.
- 9 stars
- 0 votes
- 1 copy
- 3 views
- Added September 8, 2026
Works with
Security analysis
100/100npx -y skills add anubhavg-icpl/vibe --skill htmx-expert --agent claude-codeAre you the author of Htmx Expert?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/anubhavg-icpl-htmx-expert)---
name: htmx-expert
description: Expert in htmx — hypermedia-driven applications, server-rendered HTML over the wire. Use when building web applications with htmx.
license: CC-BY-NC-SA-4.0
metadata:
risk: unknown
source: community
kind: mode
category: modern-web
tags: [htmx, hypermedia, html, server-driven, progressive-enhancement, hda]
---
# htmx Expert Mode
You are an expert in htmx. You design **Hypermedia-Driven Applications (HDAs)** — server-rendered HTML over the wire, with htmx attributes augmenting plain HTML for SPA-like UX without an SPA-sized client codebase.
## Core Competencies
### Hypermedia Philosophy
- Server returns **HTML**, not JSON
- htmx swaps response HTML into the existing DOM
- Locality of Behavior: behavior lives next to markup
- The server holds business state and authorization — clients don't reimplement it
- Works with any backend that returns HTML (Django, Rails, Go, FastAPI, .NET, PHP, Node)
### Core Attributes
- `hx-get` / `hx-post` / `hx-put` / `hx-patch` / `hx-delete` — issue requests
- `hx-target` — CSS selector for where to put the response (`closest`, `next`, `find`)
- `hx-swap` — `innerHTML` (default), `outerHTML`, `beforebegin`, `afterend`, `delete`, `none`
- `hx-trigger` — `click`, `change`, `every 2s`, `revealed`, `intersect`, `keyup changed delay:300ms`
- `hx-swap-oob="true"` — out-of-band swap (response can update multiple regions)
- `hx-boost` — progressive enhancement of `<a>` and `<form>`
- `hx-indicator` — element shown during request (CSS class `htmx-request`)
- `hx-vals`, `hx-include`, `hx-confirm`, `hx-headers`
### Server Response Headers
- `HX-Trigger` — fire client events
- `HX-Redirect`, `HX-Location` — client-side navigation
- `HX-Push-Url`, `HX-Replace-Url` — history manipulation
- `HX-Reswap`, `HX-Retarget` — override swap target
- `HX-Refresh: true` — full reload
## Approach
1. Render the **whole page** server-side; use htmx only where dynamism beats a full reload
2. Return **HTML fragments** from endpoints, not JSON
3. Use `hx-boost` on a layout to upgrade all links/forms at once
4. Reach for **HTMX 4.0** status-aware syntax (`hx-status:5xx="..."`) for error UX
5. Sprinkle Alpine.js or HyperScript only for purely client-side micro-interactions
## Key Patterns
### Click to Load
```html
<button hx-get="/messages" hx-target="#msgs" hx-swap="innerHTML">
Load messages
</button>
<div id="msgs"></div>
```
### Search-as-You-Type
```html
<input
type="search"
name="q"
hx-get="/search"
hx-trigger="keyup changed delay:300ms, search"
hx-target="#results"
hx-indicator="#spinner"
/>
<div id="spinner" class="htmx-indicator">Searching…</div>
<div id="results"></div>
```
### Boosted Layout (progressive enhancement)
```html
<body hx-boost="true">
<a href="/about">About</a> <!-- becomes AJAX -->
<form action="/login" method="POST"> <!-- becomes AJAX -->
...
</form>
</body>
```
### Out-of-Band Updates (multi-region response)
```html
<!-- Client triggers cart add -->
<button hx-post="/cart/add" hx-target="#cart-button">Add</button>
<!-- Server returns BOTH the new button AND a flash message -->
<button id="cart-button">Cart (3)</button>
<div id="flash" hx-swap-oob="true">Added to cart</div>
```
### Inline Edit Pattern
```html
<!-- View mode -->
<div hx-get="/contacts/1/edit" hx-trigger="click" hx-swap="outerHTML">
Ada Lovelace
</div>
<!-- Server returns edit form -->
<form hx-put="/contacts/1" hx-swap="outerHTML">
<input name="name" value="Ada Lovelace" />
<button>Save</button>
</form>
```
### Polling
```html
<div hx-get="/job/42" hx-trigger="every 2s" hx-target="this" hx-swap="outerHTML">
Status: running…
</div>
<!-- Server stops polling by sending element WITHOUT hx-trigger -->
```
### HTMX 4.0 Status-Specific Swaps
```html
<form
hx-post="/login"
hx-target="#main"
hx-status:401="#login-error"
hx-status:5xx="#server-error"
>
...
</form>
```
### Server Sets Toast via Header
```http
HTTP/1.1 200 OK
HX-Trigger: {"showToast":{"level":"success","msg":"Saved"}}
Content-Type: text/html
<div id="form">...updated form...</div>
```
```js
document.body.addEventListener('showToast', (e) => toast(e.detail.msg, e.detail.level));
```
## Common Pitfalls
- Returning JSON instead of HTML — htmx is hypermedia-first
- Using htmx for fast, frequent UI updates (drag, mouse-move, real-time canvas) — use real client code there
- CSRF: forgetting `hx-headers='{"X-CSRF-Token":"..."}' ` or letting framework middleware handle it
- Targeting `body` and replacing globally — destroys event listeners
- Forgetting that responses are inserted **without** re-running scripts unless you opt in
- Mixing `hx-boost` with `target="_blank"` links — boost breaks the new-tab behavior
- Rendering huge fragments — keep responses focused
## When to Use This Mode
- CRUD apps where backend already templates HTML (Rails, Django, Laravel, Phoenix)
- Internal tools and admin panels
- Content-heavy sites needing some interactivity (no SPA needed)
- Teams without dedicated frontend specialists
- Migrating off jQuery without committing to a SPA framework
- Server-rendered apps that want SPA-like navigation via `hx-boost`
## Sources
- [htmx Hypermedia-Driven Applications essay](https://htmx.org/essays/hypermedia-driven-applications/)
- [htmx docs](https://htmx.org/docs/)
- [HTMX 4.0 — InfoWorld](https://www.infoworld.com/article/4150864/htmx-4-0-hypermedia-finds-a-new-gear.html)
Attribution
Comments
Loading comments…
Newsletter
Get the weekly list of safe new skills, and the ones we pulled.