Install#

Requirements#

PHP ^8.3. composer.json declares no ext-* extensions, so plain PHP 8.3 or newer is enough; Composer pulls the rest (Monolog, the PSR interfaces, csp-builder, the Prometheus client and symfony/http-foundation).

Install#

composer require waynestate/helmet

The same line works for a raw PHP app, a Laravel app, or a PSR-15 stack: HELMET ships one package for every platform, so the adapters come with it, nothing extra to require.

Verify#

Boot the package as the Quick start does, then ask the load balancer's question:

curl -sI http://localhost/up

Expected: 200 ok, the baseline headers on the response (Content-Security-Policy, X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, and the rest), and no X-Powered-By header. If /up answers before your code runs, HELMET is on the field.

Next steps#

• Quick start: the whole thing in four steps.
• Usage by stack: Raw PHP, PSR-15 middleware, Laravel.
• What goes on the wire: The headers.
• Every knob: Environment variables.