flask-talisman
HTTP security headers for Flask.
Decision gist · record as of 2026-08-14
Yes, with conditions. Flask-Talisman is a straightforward, low-friction way to add essential security headers to Flask applications. It has no dependencies, installs cleanly, and is marked Production/Stable. However, the package is dormant—last updated in August 2023—so verify that its defaults and behavior align with current security best practices and your Flask version before deploying to production.AI-flagged interpretation of the facts on this page — verify before relying
Before you install
- Low friction installation with no runtime dependencies.
- Maintenance is dormant—last release was in August 2023, though the repository remains active and the package is marked Production/Stable.
License · maintenance · safety
Apache Software License (permissive) — Licensed under Apache Software License (permissive), allowing commercial and private use with minimal restrictions.
last release 2023-08-03 (1107 days) · last repo commit 2024-04-17 · 87 stars
0 known vulnerabilities (OSV.dev, 2026-08-14) · 2,478,870 downloads/mo, #3,046 on PyPI
Alternatives
Verify before relying
pip install flask-talisman
from flask import Flask
from flask_talisman import Talisman
app = Flask(__name__)
Talisman(app)- Whether dormant status affects compatibility with recent Flask versions or modern security standards.
- Current test coverage and whether the package has been validated against recent security guidelines.
- Compatibility with Python versions beyond 3.9, given the classifier list ends there.
What it is and what it does
Flask-Talisman is a lightweight Flask extension that wraps your application to automatically inject security-focused HTTP headers. It enforces HTTPS by default (unless debug mode is on), enables HTTP Strict Transport Security, sets secure session cookies, and applies a strict Content Security Policy to mitigate XSS attacks. It also prevents clickjacking via X-Frame-Options, disables MIME type sniffing, and controls referrer leakage.
The extension is designed to be drop-in: you instantiate it with your Flask app and it handles header injection on every response. Most settings are configurable—you can adjust CSP rules, HSTS behavior, frame options, and cookie attributes to match your application's needs. The package has no runtime dependencies, making it lightweight to add to an existing Flask project.
Use it for
- Add HTTPS enforcement and HSTS headers to a Flask app without manual header management.
- Protect against XSS attacks by applying a strict default Content Security Policy.
- Prevent clickjacking by setting X-Frame-Options and other framing controls.
- Secure session cookies automatically by marking them as secure, httponly, and samesite.
- Customize security headers per-view to allow exceptions for specific endpoints.
Worth the install?
AI-flagged interpretation of the facts on this page. Verify before relying on it.
Yes, with conditions.
Flask-Talisman is a straightforward, low-friction way to add essential security headers to Flask applications. It has no dependencies, installs cleanly, and is marked Production/Stable. However, the package is dormant—last updated in August 2023—so verify that its defaults and behavior align with current security best practices and your Flask version before deploying to production.
Install
flask-talisman on PyPI
Before you install
Low friction installation with no runtime dependencies. Maintenance is dormant—last release was in August 2023, though the repository remains active and the package is marked Production/Stable.
License in practice
Licensed under Apache Software License (permissive), allowing commercial and private use with minimal restrictions.
Quickstart
pip install flask-talisman
from flask import Flask
from flask_talisman import Talisman
app = Flask(__name__)
Talisman(app)Verify before relying
- Whether dormant status affects compatibility with recent Flask versions or modern security standards.
- Current test coverage and whether the package has been validated against recent security guidelines.
- Compatibility with Python versions beyond 3.9, given the classifier list ends there.
Package facts
| License | Apache Software License permissive |
| Python support | Not specified |
| Install friction | Low. Pure-Python wheel |
| Runtime dependencies | None |
| Maintenance | Dormant 1,107 days since the last release |
| Last repo commit | |
| First released | |
| Downloads | 2,478,870 / month, #3,046 on PyPI 30-day window, as of 2026-08-14 |
| Known vulnerabilities | None known OSV.dev, checked 2026-08-14 |
| Classifiers | Development Status :: 5 - Production/StableIntended Audience :: DevelopersLicense :: OSI Approved :: Apache Software LicenseOperating System :: MacOSOperating System :: POSIXOperating System :: UnixProgramming Language :: PythonProgramming Language :: Python :: 3Programming Language :: Python :: 3.5Programming Language :: Python :: 3.6Programming Language :: Python :: 3.7Programming Language :: Python :: 3.8Programming Language :: Python :: 3.9Topic :: Software Development :: Libraries :: Python Modules |
Evidence: flask_talisman-1.1.0-py2.py3-none-any.whl
Tags
Let your AI agent find packages like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 14,416 PyPI packages by what they can do, searchable in plain language.
wish › “flask security headers”
- flask-talismanFlask extension that automatically sets HTTP security headers to…
- flask-corsFlask-CORS handles Cross-Origin Resource Sharing (CORS) headers in…
- python-ipwareExtracts a client's IP address from web request headers, handling…
Give your agent the search over MCP, or paste the wish link into any chat.
More Python Modules packages
Converts domain names between Unicode and ASCII-compatible encoding (Punycode) according to IDNA 2008 and Unicode Technical Standard 46, with security validation and broader script coverage than the standard library.
Install it if you work with internationalized domain names, need to validate domains, or use HTTP clients that depend on it transitively.
Setuptools is a Python build backend and package management tool that handles building, distributing, and installing Python packages, including support for C/C++ extension modules.
PyYAML parses and emits YAML 1.1 data format, enabling serialization and deserialization of configuration files and Python objects to and from human-readable YAML text.
Pydantic validates Python data structures against type hints, coercing and checking input at runtime to ensure it matches a declared schema.
Provides reusable metadata objects for use with PEP-593 `typing.Annotated` to express common constraints like bounds, collection sizes, and predicates on types.
Install it if you use or build libraries that need to express type constraints in a standardized, inspectable way—or if you want to annotate your own types with…
Provides runtime tools to inspect and introspect Python type annotations, enabling programmatic examination of type hints at execution time.
See also secure · Flask-Paranoid · Secweb · asgi-csrf · hstspreload · flask-unsign · flask-cors · fastapi-csrf-protect · django-permissions-policy · django-csp