Nuxt 2 is reaching End-of-Life on June 30th, 2024.


Security Module for Nuxt based on OWASP Top 10 and Helmet


npm versionnpm downloadsGithub Actions CILicenseNuxt

Nuxt Security

Automatically configure your app to follow OWASP security patterns and principles by using HTTP Headers and Middleware.

This module works with Nuxt 3 only


  • Security response headers (including CSP for SSG apps)
  • Request Size & Rate Limiters
  • Cross Site Scripting (XSS) Validation
  • Cross-Origin Resource Sharing (CORS) support
  • Hide X-Powered-By header and remove console loggers utils
  • [Optional] Allowed HTTP Methods, Basic Auth, CSRF


Install the module:

npx nuxi@latest module add security

And that's it! The module will now register route rules and server middlewares globally so that your application will be more secured.


You can pass configuration to the module in the nuxt.config.ts like following:

export default defineNuxtConfig({
  modules: ["nuxt-security"],
  security: {
    // options

For all available configuration options check out the docs.


  • Run yarn dev:prepare to generate type stubs.
  • Use yarn dev to start playground in development mode.


MIT License