Frequently asked questions (FAQ)

How do I conditionally skip a header?
How do I conditionally set header options?
What modules are similar to Helmet?
What if I don’t want to install Helmet?
How do I use Helmet without Express?
How do I upgrade from Helmet 3 to Helmet 4?
How do I set a Content Security Policy nonce?
How do I set both Content-Security-Policy and Content-Security-Policy-Report-Only headers?
How do I set legacy Content Security Policy headers?
How should I use Helmet with non-document responses?
How do I set a custom X-Powered-By header?
How do I disable blocking with the X-XSS-Protection header?
How do I enable the report directive with the X-XSS-Protection header?
How do I use X–Frame–Options’s ALLOW–FROM directive?
Who made Helmet?