Helmet in Node.js: Secure Your Express App with HTTP Headers – DevVault Blogs

Helmet is a popular Node.js middleware that helps secure your Express (or Connect) applications by setting various HTTP security headers. By default, Express and other Node.js frameworks send minimal headers, which can leave your app vulnerable to common web attacks like clickjacking, XSS, and MIME-sniffing. Helmet sets sensible defaults for over a dozen security-related headers, and you can add it to your app with a single line. This guide covers installation, usage, the headers Helmet sets, and how to customize them for your needs.

What is Helmet?

A collection of middleware for HTTP security headers

Helmet is not a single middleware—it’s a collection of smaller middlewares that each set one or more security-related HTTP headers. When you call helmet(), it applies all of them by default. This includes headers like X-Content-Type-Options (prevents MIME sniffing), X-Frame-Options (prevents clickjacking), Strict-Transport-Security (enforces HTTPS), Content-Security-Policy, and more. You get immediate security improvements without writing header logic yourself.

Installation and Basic Usage

Add Helmet to your Express app in minutes

npm install helmet

const express = require('express');
const helmet = require('helmet');

const app = express();

// Add Helmet - apply all security headers
app.use(helmet());

app.get('/', (req, res) => {
  res.send('Hello World');
});

app.listen(3000);

That’s it. Add app.use(helmet()) before your routes, and Helmet will set all default security headers on every response.

Security Headers Helmet Sets

What each default middleware does

Content-Security-Policy (CSP)

Helps prevent XSS and data injection by controlling which resources (scripts, styles, images) the browser can load. Helmet’s default CSP is strict—you may need to customize it if your app uses inline scripts, CDNs, or third-party widgets.

X-Content-Type-Options

Set to nosniff to prevent browsers from MIME-sniffing responses. Stops the browser from interpreting a response as a different content type than declared (e.g., treating plain text as JavaScript).

X-Frame-Options

Set to SAMEORIGIN by default to prevent clickjacking. Blocks your site from being embedded in iframes on other domains.

Strict-Transport-Security (HSTS)

Forces browsers to use HTTPS for future requests. Only enabled when the request is over HTTPS. Use with caution on first deployment—ensure HTTPS is working before enabling.

Other Headers

Helmet also sets X-DNS-Prefetch-Control, X-Download-Options, X-Permitted-Cross-Domain-Policies, Referrer-Policy, and more. Check the Helmet documentation for the full list.

Customizing Helmet

Configure individual middlewares or disable some

You can pass options to helmet() to customize or disable specific middlewares. For example, to relax Content-Security-Policy for a site that uses inline scripts or Bootstrap from a CDN:

app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'", "'unsafe-inline'", "https://cdn.example.com"],
      styleSrc: ["'self'", "https://fonts.googleapis.com"],
      imgSrc: ["'self'", "data:", "https:"],
    },
  },
  crossOriginEmbedderPolicy: false, // disable if needed for cross-origin resources
}));

You can also use individual Helmet middlewares instead of the full bundle. For example: app.use(helmet.contentSecurityPolicy()) or app.use(helmet.xssFilter()) if you only want specific headers.

Conclusion

Strengthen your Express app’s security in seconds