What does helmet do in an Express app, and which security headers matter most?

helmet sets security headers in one line: app.use(helmet()). Security headers tell the browser to turn on protections. Helmet sets a sensible baseline. It also removes the X-Powered-By header, because that header tells attackers which framework you use.

The most important headers:

• Content-Security-Policy (CSP) limits where scripts, styles and frames can load from. It is the main protection against XSS (cross-site scripting).
• Strict-Transport-Security (HSTS) makes browsers use only HTTPS for your domain.
• X-Content-Type-Options: nosniff stops MIME sniffing, where the browser guesses a file's type. Without it, the browser could treat an uploaded file as script.
• X-Frame-Options and the CSP frame-ancestors rule stop other sites from putting your page in a frame. This prevents clickjacking, where a hidden frame tricks the user into clicking.
• Referrer-Policy limits how much of your URLs leak to other sites.

Helmet also sets X-XSS-Protection: 0. This turns off the old browser XSS filter, because that filter caused security problems of its own.

You usually need to adjust the default CSP for your app. Turn on HSTS only once the whole domain serves HTTPS.