- How do I install mikefrancis/laravel-secureheaders in a Laravel app?
- Run composer require mikefrancis/laravel-secureheaders, then publish the config file with php artisan vendor:publish so you can adjust the header values. The service provider is auto-discovered, and the package ships a middleware class you register globally or on a route group. No database migrations or infrastructure changes are needed, so first-pass integration is quick. Verify the headers appear on real responses with curl -I before relying on the defaults.
- Does mikefrancis/laravel-secureheaders work with Laravel 10, 11, or 12?
- The last release was in May 2021, which predates Laravel 10, 11, and 12 and the PHP 8.1+ baseline, so the Composer constraints may block installation on a current stack. Check the php and laravel/framework constraints in the package's composer.json before committing. Because the wrapper is small, the cheapest fix is usually to fork it and widen the constraints rather than abandon it. Also confirm service-provider auto-discovery and the publish tag still resolve on your target major version.
- Which security headers does this Laravel package add by default?
- It applies a sensible default set covering Content-Security-Policy, Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy, plus related protections against clickjacking and MIME sniffing. All values are configurable, so you can tighten or relax individual headers per environment. Defaults are a starting point, not an audited policy, so review each header against your application's actual front-end and third-party requirements.
- How do I register the SecureHeaders middleware in Laravel?
- On Laravel 10 and earlier you add the middleware class to the $middleware array in app/Http/Kernel.php for a global registration, or to a route group's middleware list for scoped coverage. On Laravel 11 and later, registration happens in bootstrap/app.php via the middleware configuration. Globally registered middleware is the simplest choice because it protects every response, including error pages. Keep its position in mind relative to compression, caching, and CORS middleware.
- How do I customize or disable a specific security header?
- Publish the package config file and edit the header values there; each header the package sets is driven by that configuration. To drop a header, remove its entry or set it to a permissive value rather than leaving a conflicting default in place. Because configuration is cached in production, run php artisan config:cache after changes. Confirm the result on a real response with curl -I rather than assuming the config took effect.
- Does it support CSP nonces or hashes for inline scripts?
- The package is a thin wrapper around aidantwoods/secureheaders and exposes configurable header values, so nonce support depends on what that underlying library provides and whether the wrapper surfaces it. Verify this explicitly against the source before designing around it. If nonces are not available, you can extend the middleware to generate a per-request nonce and build the Content-Security-Policy header yourself. Hashes for static inline blocks are a simpler alternative when you control the markup.
- Will a strict Content-Security-Policy break my Vite, Livewire, or Inertia front end?
- It can. A strict CSP commonly breaks inline scripts, eval-based libraries, third-party widgets, and asset loading from Vite, Livewire, or Inertia when the policy is misconfigured. Deploy first in report-only mode, collect violation reports from real traffic, and tune the policy before switching to enforce mode. Enable the enforcing policy per environment so staging can stay permissive while production is locked down.
- What happens if my CDN or reverse proxy also sets the same security headers?
- You can end up with duplicate or conflicting header values, and many CDNs overwrite headers set by the origin. Decide who owns each header: either the application middleware or the edge configuration, not both. Duplicate HSTS values are usually harmless, but conflicting Content-Security-Policy values combine restrictively and can silently break your site. Test through the CDN with curl -I, not just against the origin.
- Is this package compatible with Laravel Octane?
- Yes. The middleware is stateless, with no database, cache, queue, or external service dependency, so it composes cleanly with Octane and long-running workers. Because it only touches the outgoing response path, there is no per-request state to leak between requests. Just remember to restart Octane workers after changing configuration so cached headers are rebuilt.
- What are the alternatives if mikefrancis/laravel-secureheaders is unmaintained?
- Maintained equivalents such as bepsvpt/laravel-security-header or a Spatie package cover the same ground, and you can also inline roughly 50 lines of custom middleware to remove the dependency entirely. Forking this package and widening its Composer constraints is inexpensive given the code size, and keeps the configuration you already wrote. Run a short spike to confirm resolution on your target Laravel and PHP versions before choosing a path. For JSON-only APIs the benefit is narrower, so HSTS, X-Content-Type-Options, and Referrer-Policy may be all you need.