express-security-headers

Lightweight Express.js middleware for setting security-related HTTP headers.

npm install express-security-headers

const express = require('express');
const { securityHeaders } = require('express-security-headers');

const app = express();
app.use(securityHeaders());

• X-Content-Type-Options: nosniff
• X-Frame-Options: DENY
• Strict-Transport-Security (HSTS)
• Content-Security-Policy
• X-XSS-Protection
• Referrer-Policy

MIT