Skip to content
Get packs

Helmet

Express middleware that sets secure HTTP response headers with one line of code.

GitHub Download source
Stars
10.7k
Forks
410
Licence
MIT
Language
TypeScript
Last update
5 days ago
Type
Library

What it is

Helmet is a middleware package for Node.js and Express apps. It sets HTTP response headers, such as Content-Security-Policy and Strict-Transport-Security, that tell browsers how to handle your site more safely. The README says it aims to be quick to integrate and low maintenance afterward.

  • Add default security headers to an Express app with a single app.use(helmet()) call
  • Turn off specific headers, such as Content-Security-Policy, that conflict with your app
  • Customize the Content-Security-Policy directives for your scripts and styles, including nonces
  • Set Content-Security-Policy-Report-Only to test a policy before enforcing it

Great for

  • Developers building Express web apps who want sensible security headers by default
  • Teams that want to add a baseline of browser-side protection without writing headers by hand
  • Projects that need to tune individual headers, such as a Content-Security-Policy for their own scripts

Not ideal for

  • Non-Express frameworks or setups where this middleware does not apply, since the README is written around Express
  • People who do not control response headers, such as those hosting only static files on a service that sets its own headers
  • Anyone expecting it to replace server-side input validation or a full security review; the README says Helmet performs very little validation of your CSP
Step-by-step guide: how to use HelmetInstall, first run, examples, tips and FAQs

How to get it

  1. 1

    Install with a package manager

    You'll need: Node.js · Express

    Install from npm

    git clone https://github.com/helmetjs/helmet
  2. 2

    Run it

    • Install the helmet package into your Express project
    • Import helmet and call app.use(helmet()) before your routes
    • Run your app and check the response headers in your browser's developer tools
    • Adjust or disable individual headers through the helmet options if needed
  3. 3

    Get the most out of it

    • Read the Content-Security-Policy section and pass your own directives, using camelCase or kebab-case names
    • Use a nonce via res.locals to allow specific inline scripts while keeping the policy strict
    • Use useDefaults: false if you want to write a fully custom CSP
    • Check your policy with CSP Evaluator, as the README recommends
    • Use the per-header standalone middleware, such as helmet.crossOriginOpenerPolicy(), if you want only some headers

Downloads

Source code (.zip)main branch · straight from GitHubOfficial website & docshelmet.js.org/

Strengths

  • Setup is one line for the default configuration, according to the README
  • Each header can be disabled or configured individually
  • Can be used as standalone middleware per header

Trade-offs

  • The README says the Content-Security-Policy header is powerful but likely needs configuration for your app
  • Helmet performs very little validation of CSP, so you should check policies with an external checker
  • Default upgrade-insecure-requests can cause problems in development, such as with Safari and localhost

How it compares

ProjectStarsTypeLevelUpdatedBest for
helmet (this)10.7kLibrarybeginner5 days agoDevelopers building Express web apps who want sensible security headers by default
gin89.5kLibraryintermediate27 days agoGo developers building REST APIs
echo32.8kLibraryintermediate6 days agoGo developers building REST APIs or backend services
openzeppelin-contracts27.3kLibraryintermediate4 days agoDevelopers writing Solidity smart contracts who need standard tokens or permission systems
anubis23.9kAppintermediate4 days agoOperators of small websites or self-hosted services being overwhelmed by AI crawler traffic
API-Security-Checklist23.3kLearning resourcebeginner4 months agoDevelopers reviewing an API design before launch

Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.