Docs

Helmet is a collection of 12 middleware to help set some security headers.

First, run npm install helmet --save for your app. Then, in an Express (or Connect) app:

var express = require('express')
var helmet = require('helmet')

var app = express()

app.use(helmet())

// ...

It’s best to use Helmet early in your middleware stack so that its headers are sure to be set.

You can also use its pieces individually:

app.use(helmet.noCache())
app.use(helmet.frameguard())

You can disable a middleware that’s normally enabled by default. This will disable frameguard but include the other defaults.

app.use(helmet({
  frameguard: false
}))

You can also set options for a middleware. Setting options like this will always include the middleware, whether or not it’s a default.

app.use(helmet({
  frameguard: {
    action: 'deny'
  }
}))

If you’re using Express 3, make sure these middlewares are listed before app.router.

Visit each module’s page to learn more.