# @middy/http-security-headers

> Applies best practice security headers to responses. It's a simplified port of HelmetJS

Latest version **7.9.2** (published 2026-08-27) · MIT license · 0 weekly downloads

## Install

```sh
npm install @middy/http-security-headers
pnpm add @middy/http-security-headers
yarn add @middy/http-security-headers
bun add @middy/http-security-headers
```

## Health

**Score 75/100 (B)** — status: active.

Positive: has types; esm support; no vulnerabilities; has provenance; recently updated; high maintenance score; high quality score.

Warnings: low downloads.

## Facts

| | |
|---|---|
| Version | 7.9.2 |
| Published | 2026-08-27 |
| First published | 2019-12-04 |
| Weekly downloads | 0 |
| License | MIT |
| TypeScript types | bundled |
| Module format | ESM |
| Node | >=22 |
| Dependencies | 1 |
| Unpacked size | 19.6 KB |
| Known vulnerabilities | 0 |
| Install scripts | no |
| Provenance | attested (GitHub Actions) |
| GitHub stars | 3905 |
| Author | Middy contributors |
| Maintainers | lmammino, middyjs, willfarrell |
| Keywords | Lambda, Middleware, Serverless, Framework, AWS, AWS Lambda, Middy, HTTP, API, Header, Headers, Helmet, Security |

## Links

- npm: https://www.npmjs.com/package/@middy/http-security-headers
- Repository: https://github.com/middyjs/middy
- Homepage: https://middy.js.org
- Issues: https://github.com/middyjs/middy/issues
- Funding: https://github.com/sponsors/willfarrell
- npm.io page: https://npm.io/package/@middy/http-security-headers

## Dependencies (1)

- [@middy/util](https://npm.io/package/@middy/util.md) 7.9.2

## Alternatives

- [launchdarkly-js-client-sdk](https://npm.io/package/launchdarkly-js-client-sdk.md) — 2.5M weekly downloads
- [@elastic/elasticsearch](https://npm.io/package/@elastic/elasticsearch.md) — 2.1M weekly downloads
- [@c8y/client](https://npm.io/package/@c8y/client.md) — 15.3K weekly downloads
- [@signaldb/maverickjs](https://npm.io/package/@signaldb/maverickjs.md) — 1.7K weekly downloads
- [@bbc/http-transport-cache](https://npm.io/package/@bbc/http-transport-cache.md) — 1.2K weekly downloads

## Recent versions

- 7.9.2 (latest) — 2026-08-27
- 8.0.0-alpha.1 (next) — 2026-09-19
- 7.8.0 — 2026-08-20
- 7.7.4 — 2026-08-14
- 7.7.3 — 2026-08-12
- 7.7.2 — 2026-07-22
- 7.7.0 — 2026-06-23
- 7.6.8 — 2026-06-19
- 7.6.7 — 2026-06-07
- 7.6.6 — 2026-06-07
- 7.6.5 — 2026-05-22
- 7.6.4 — 2026-05-17
- 7.6.3 — 2026-05-16
- 7.6.2 — 2026-05-15
- 7.6.1 — 2026-05-15
- … 221 more at https://npm.io/package/@middy/http-security-headers/versions

## README

<div align="center">
  <h1>Middy `http-security-headers` middleware</h1>
  <img alt="Middy logo" src="https://raw.githubusercontent.com/middyjs/middy/main/docs/img/middy-logo.svg"/>
  <p><strong>HTTP security headers middleware for the middy framework, the stylish Node.js middleware engine for AWS Lambda</strong></p>
  <p>Applies best practice security headers to responses. It's a simplified port of [HelmetJS](https://helmetjs.github.io/). See HelmetJS documentation for more details.</p>
  <p>
    <a href="https://github.com/middyjs/middy/actions/workflows/test-unit.yml"><img src="https://github.com/middyjs/middy/actions/workflows/test-unit.yml/badge.svg" alt="GitHub Actions unit test status"></a>
    <a href="https://github.com/middyjs/middy/actions/workflows/test-dast.yml"><img src="https://github.com/middyjs/middy/actions/workflows/test-dast.yml/badge.svg" alt="GitHub Actions dast test status"></a>
    <a href="https://github.com/middyjs/middy/actions/workflows/test-perf.yml"><img src="https://github.com/middyjs/middy/actions/workflows/test-perf.yml/badge.svg" alt="GitHub Actions perf test status"></a>
    <a href="https://github.com/middyjs/middy/actions/workflows/test-sast.yml"><img src="https://github.com/middyjs/middy/actions/workflows/test-sast.yml/badge.svg" alt="GitHub Actions SAST test status"></a>
    <a href="https://github.com/middyjs/middy/actions/workflows/test-lint.yml"><img src="https://github.com/middyjs/middy/actions/workflows/test-lint.yml/badge.svg" alt="GitHub Actions lint test status"></a>
    <br/>
    <a href="https://www.npmjs.com/package/@middy/http-security-headers"><img alt="npm version" src="https://img.shields.io/npm/v/@middy/http-security-headers.svg"></a>
    <a href="https://packagephobia.com/result?p=@middy/http-security-headers"><img src="https://packagephobia.com/badge?p=@middy/http-security-headers" alt="npm install size"></a>
    <a href="https://www.npmjs.com/package/@middy/http-security-headers">
    <img alt="npm weekly downloads" src="https://img.shields.io/npm/dw/@middy/http-security-headers.svg"></a>
    <a href="https://www.npmjs.com/package/@middy/http-security-headers#provenance">
    <img alt="npm provenance" src="https://img.shields.io/badge/provenance-Yes-brightgreen"></a>
    <br/>
    <a href="https://scorecard.dev/viewer/?uri=github.com/middyjs/middy"><img src="https://api.scorecard.dev/projects/github.com/middyjs/middy/badge" alt="Open Source Security Foundation (OpenSSF) Scorecard"></a>
    <a href="https://slsa.dev"><img src="https://slsa.dev/images/gh-badge-level3.svg" alt="SLSA 3"></a>
    <a href="https://github.com/middyjs/middy/blob/main/docs/CODE_OF_CONDUCT.md"><img src="https://img.shields.io/badge/Contributor%20Covenant-2.1-4baaaa.svg"></a>
    <a href="https://biomejs.dev"><img alt="Checked with Biome" src="https://img.shields.io/badge/Checked_with-Biome-60a5fa?style=flat&logo=biome"></a>
    <a href="https://conventionalcommits.org"><img alt="Conventional Commits" src="https://img.shields.io/badge/Conventional%20Commits-1.0.0-%23FE5196?logo=conventionalcommits&logoColor=white"></a>
    <a href="https://github.com/middyjs/middy/blob/main/package.json#L32">
    <img alt="code coverage" src="https://img.shields.io/badge/code%20coverage-100%25-brightgreen"></a>
    <br/>
  </p>
<p>You can read the documentation at: <a href="https://middy.js.org/docs/middlewares/http-security-headers">https://middy.js.org/docs/middlewares/http-security-headers</a></p>
</div>

## Install

```bash
npm install --save @middy/http-security-headers
```


## Documentation and examples

For documentation and examples, refer to the main [Middy monorepo on GitHub](https://github.com/middyjs/middy) or [Middy official website](https://middy.js.org/docs/middlewares/http-security-headers).


## Contributing

Everyone is very welcome to contribute to this repository. Feel free to [raise issues](https://github.com/middyjs/middy/issues) or to [submit Pull Requests](https://github.com/middyjs/middy/pulls).


## License

Licensed under [MIT License](https://github.com/middyjs/middy/blob/main/LICENSE). Copyright (c) 2017-2026 [will Farrell](https://github.com/willfarrell), [Luciano Mammino](https://github.com/lmammino), and [Middy contributors](https://github.com/middyjs/middy/graphs/contributors).

---
_Source: https://npm.io/package/@middy/http-security-headers · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._