helmetjs/helmet

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

10729 stars · 412 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Helmet is a Node.js middleware library that secures Express and Connect apps by setting HTTP response headers such as Content-Security-Policy and Strict-Transport-Security. It sets 13 security headers by default, each of which can be disabled or individually configured.

Use cases

• secure an express app with http security headers
• set content-security-policy in node.js
• add strict-transport-security header
• prevent clickjacking with x-frame-options
• harden http response headers in node.js
• mitigate xss attacks via csp headers

When to choose

• you run an Express or Connect app and want quick, low-maintenance security headers
• you need configurable CSP directives with sensible defaults
• you want a one-line middleware covering 13 security headers

When to avoid

• you need application-level security like authentication, input validation, or rate limiting
• your app is not Node.js-based
• you need a web application firewall or runtime threat detection

Facets

library · maturity stable

security middleware http-server security web-development backend express http-headers content-security-policy hsts connect nodejs web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="helmetjs/helmet")