Game film · 2026-10-28 · 82 snaps

82 Wayne State applications suited up with HELMET on 2026-10-28: 81 passed, 0 tool errors.

Each app was copied, booted in php:8.4-apache with no network, and HELMET called before the app's first line, the way the README says to. Then the probe asked for /up and the front page over a simulated HTTPS proxy and read every header that came back. One app never let HELMET onto the field, and the film says why.

HELMET 0.1.0
commit 87c83d2
image php:8.4-apache
network none
median boot and probe 13.9 s

First quarter · The tally

Eighty-two snaps, one call each

An app passes when /up answers ok and every response that runs through HELMET carries the full set: a CSP with a fresh nonce, frame-ancestors, nosniff, Referrer-Policy, Permissions-Policy, COOP, HSTS on trusted HTTPS, and no X-Powered-By. The app itself is not on trial; a page that errors still has to wear the helmet.

81Passed/up answered, every header present
0Flaggedno app crashed out from under HELMET
0Tool errorsno missing header, no failed /up
1Not applicableits .htaccess redirects to HTTPS before PHP runs

One mark per application, in the order of its anonymous id. This repository is public, so the apps are counted and never named.

Second quarter · Game film

What came back over the wire

Every response was read header by header. These are counts across the 81 apps HELMET ran on; the per-app film stays in the stack's internal record.

Headers on the response that ran through helmet_boot()
Protection	Apps	Note
CSP with a per-request nonce	81	`strict-dynamic`, `object-src 'none'`, `base-uri 'self'`
frame-ancestors and X-Frame-Options	81	`'self'` and `SAMEORIGIN`
X-Content-Type-Options	81	`nosniff`
Referrer-Policy	81	`strict-origin-when-cross-origin`
Permissions-Policy	81	camera, geolocation, microphone, payment and usb off
Cross-Origin-Opener-Policy	81	`same-origin`
Strict-Transport-Security	81	only because the request came through a trusted proxy as HTTPS
X-Powered-By removed	81	on every page HELMET serves after boot

How /up was reached

public/up.php calling helmet_up()64
/up through the app's own rewrite17

The app's own front page

index.php answered, headers on55
no PHP front door (403)25
static index.html1

What the film caught

On the 17 apps whose own rewrite sends /up into helmet_boot(), the health answer goes out before X-Powered-By is stripped, so /up still says which PHP it runs. That is a one-line fix, queued for the next tag with a test. Three apps set a session cookie on their front page, and all three got Secure, HttpOnly and SameSite from HELMET's session settings. The libraries (6), the starter template and Citadel's six PHP test pages ran too: all passed, and two test pages that need their own config to render still wore every header.

Third quarter · Run the play

Run it on your own app

Install HELMET, call helmet_boot() at the top of the front controller, and read your own headers.

Install

composer require waynestate/helmet

First lines of public/index.php

<?php
require __DIR__ . '/../vendor/autoload.php';
$helmet = Waynestate\Helmet\helmet_boot(['preset' => 'citadel']);

Read the headers (behind your HTTPS proxy)

curl -sI https://your-app.example/ && curl -s https://your-app.example/up

The proof rig did the same with auto_prepend_file so no app file had to change, trusted only the loopback proxy, and sent X-Forwarded-Proto: https the way a platform proxy does. Each boot is logged as one line (tool commit, anonymous unit id, app commit, command, exit code, duration, outcome) in the stack's internal record.

Fourth quarter · The fine print

What this does not prove

It proves the headers go out, not that each app's pages work under the CSP. An app with inline scripts needs their nonces before the policy stops blocking them; that is the app's work, and the CSP report endpoint is how to find it.
No app reached a real database, Oracle, CAS or any Wayne State service. Most front pages rendered without one; deeper pages that need one were not visited.
It ran on PHP 8.4 only, the platform's current image. An app whose code would not parse on 8.4 still gets HELMET's answer at /up and its headers, because HELMET runs before the app does; whether the app itself works on 8.4 is BOOSTER's question.
HTTPS was simulated through a trusted proxy header over loopback. The one app that redirects to HTTPS in its own .htaccess never let PHP run, so it counts as not applicable, not as a pass.
It covers the raw PHP path. The Laravel middleware has its own tests; a Laravel boot proof waits for apps whose dependencies install without Wayne State's private registries.

81 snaps, 0 concussions. Size Matters, and so do headers.