# helmetjs/helmet

Help secure Express apps with various HTTP headers

Repository: https://github.com/helmetjs/helmet
Canonical: https://ross.abutalabs.com/products/helmet
Homepage: https://helmet.js.org/
Language: TypeScript
License: MIT
License Family: permissive
Topics: javascript, middleware, security, helmet, http-headers
Last push: 2026-08-01T00:02:40+00:00

## Health v2 (maintenance only)
Score: 75/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 95, release rhythm 35, longevity 100
- inputs: {"age_days": 5327, "days_push": 33, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 10729, forks 412 (observed 2026-08-28T04:10:43.917872+00:00)

## What it is
Helmet is a Node.js middleware library that secures Express and Connect apps by setting HTTP response headers such as Content-Security-Policy and Strict-Transport-Security. It sets 13 security headers by default, each of which can be disabled or individually configured.

## Use cases
- secure an express app with http security headers
- set content-security-policy in node.js
- add strict-transport-security header
- prevent clickjacking with x-frame-options
- harden http response headers in node.js
- mitigate xss attacks via csp headers

## When to choose
- you run an Express or Connect app and want quick, low-maintenance security headers
- you need configurable CSP directives with sensible defaults
- you want a one-line middleware covering 13 security headers

## When to avoid
- you need application-level security like authentication, input validation, or rate limiting
- your app is not Node.js-based
- you need a web application firewall or runtime threat detection

## Facets
- artifact type: library
- maturity: stable
- function: security, middleware, http-server
- domain: security, web-development, backend
- platform: -
- tags: express, http-headers, content-security-policy, hsts, connect, nodejs, web-server

## Member repositories
- helmetjs/helmet (main) score 75

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:10:43.917872+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:17:55.978377+00:00, confidence not recorded.
  - readme: https://github.com/helmetjs/helmet (fetched 2026-08-28T04:10:43.917872+00:00, sha c468c90f88b1)
  - homepage: https://helmet.js.org/ (fetched 2026-08-29T08:17:22.543206+00:00, sha 024ec7ab7ab2)
  - registry_npm: https://registry.npmjs.org/helmet (fetched 2026-08-29T08:17:22.546244+00:00, sha d1d03c91edc1)
- Data as of 2026-08-30T08:39:29.467469+00:00.