What is helmet?

Helmet is a small library for Node.js web apps that adds a layer of security by automatically setting certain HTTP response headers. HTTP headers are short pieces of metadata that travel along with every web page response, telling browsers how to behave. Some headers, when set correctly, instruct browsers to block common attacks like cross-site scripting, where malicious code from one site tries to run on another. When you add Helmet to an Express app, a single line of code activates 13 protective headers at once. The defaults are chosen to cover a broad range of common threats without breaking typical sites. For example, the Content-Security-Policy header limits which external scripts and styles a page can load, reducing the risk of injected code. The Strict-Transport-Security header tells browsers to always use a secure HTTPS connection rather than plain HTTP. The Cross-Origin-Resource-Policy header prevents other sites from embedding your resources without permission. Every header Helmet sets can be turned off or adjusted. If your app loads scripts from a third-party domain, you can add that domain to the allowed list for Content-Security-Policy. If a particular header causes problems with your setup, you can disable it by passing false for that setting. The configuration is all done through a plain JavaScript object, so there is no separate config file to manage. Helmet is designed to stay out of the way once it is installed. It does not log anything, does not make network calls, and does not change how your routes or business logic work. It only modifies outgoing response headers. The README acknowledges that Helmet does minimal validation of your Content-Security-Policy settings and recommends checking your policy with an external tool if you want to verify correctness. The library works with Express and also supports standalone Node.js or other compatible frameworks. It is maintained separately from Express itself and is widely used as a first step when securing a new Node.js project.