The helmet middleware sets a group of security response headers for an Express app and removes X-Powered-By. It is a sensible default, but headers are one layer. Hiding the framework name only deters casual attackers, as the Express docs themselves say.
What helmet does
Per the Express security best practices page, helmet sets headers including Content-Security-Policy, Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Cross-Origin-Resource-Policy. It also removes X-Powered-By. Each header can be configured or disabled.
const helmet = require('helmet');
app.use(helmet());
Put it near the top, before routes, so every response gets the headers, including errors.
Why each header exists
- Content-Security-Policy: Limits where scripts and other resources may load from
- Strict-Transport-Security: Tells browsers to keep using HTTPS
- X-Content-Type-Options: Stops browsers guessing content types
- X-Frame-Options: Limits framing of your pages
- Referrer-Policy: Controls what URL data is sent to other sites
- Cross-Origin-Resource-Policy: Limits who can load your resources
A default Content Security Policy can break pages that use inline scripts or third party assets. Test it, then tune the directives instead of switching the header off.
Fingerprinting
Express adds X-Powered-By by default. You can disable it with app.disable('x-powered-by'), though helmet already does. The docs say this only deters casual attackers. A determined one can identify a framework in other ways. So do it, but do not count it as protection.
The docs also suggest replacing the default 404 response with your own middleware and defining a custom error handler with four arguments, (err, req, res, next). The point is to avoid leaking stack traces and framework defaults to users.
What helmet does not do
It does not validate input, authenticate users, stop injection, or fix vulnerable dependencies. The docs separately recommend parameterized queries for SQL, filtering user input for XSS and command injection, and running npm audit for dependencies.
Safeguard's dependency scanning covers the package side of an Express app, and a free scan is available at gold.safeguard.sh/scan.
Quick check
Is helmet enough to secure an Express app?
No. It sets response headers. You still need input validation, authentication, safe queries and patched dependencies.
Does hiding X-Powered-By help?
A little. The Express docs say it only deters casual attackers.
Sources
Last reviewed: 19 October 2026.
