---
id: flask-talisman
version: "1.1.0"
license: Apache Software License
license_treatment: permissive
maintenance: dormant
---

# flask-talisman — HTTP security headers for Flask.

License: permissive · Maintenance: dormant · Downloads: 2.5M/mo

## What it is and what it does

Flask-Talisman is a lightweight Flask extension that wraps your application to automatically inject security-focused HTTP headers. It enforces HTTPS by default (unless debug mode is on), enables HTTP Strict Transport Security, sets secure session cookies, and applies a strict Content Security Policy to mitigate XSS attacks. It also prevents clickjacking via X-Frame-Options, disables MIME type sniffing, and controls referrer leakage.

The extension is designed to be drop-in: you instantiate it with your Flask app and it handles header injection on every response. Most settings are configurable—you can adjust CSP rules, HSTS behavior, frame options, and cookie attributes to match your application's needs. The package has no runtime dependencies, making it lightweight to add to an existing Flask project.

Use it for:

- Add HTTPS enforcement and HSTS headers to a Flask app without manual header management.
- Protect against XSS attacks by applying a strict default Content Security Policy.
- Prevent clickjacking by setting X-Frame-Options and other framing controls.
- Secure session cookies automatically by marking them as secure, httponly, and samesite.
- Customize security headers per-view to allow exceptions for specific endpoints.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Flask extension that automatically sets HTTP security headers to protect against common web vulnerabilities like XSS, clickjacking, and MIME sniffing.

Yes, with conditions. Flask-Talisman is a straightforward, low-friction way to add essential security headers to Flask applications. It has no dependencies, installs cleanly, and is marked Production/Stable. However, the package is dormant—last updated in August 2023—so verify that its defaults and behavior align with current security best practices and your Flask version before deploying to production.

## Install

pip install flask-talisman
uv add flask-talisman
poetry add flask-talisman

## Installing flask-talisman

Before you install: Low friction installation with no runtime dependencies. Maintenance is dormant—last release was in August 2023, though the repository remains active and the package is marked Production/Stable.

License in practice: Licensed under Apache Software License (permissive), allowing commercial and private use with minimal restrictions.

Quickstart:

pip install flask-talisman

from flask import Flask
from flask_talisman import Talisman

app = Flask(__name__)
Talisman(app)

Verify before relying:

- Whether dormant status affects compatibility with recent Flask versions or modern security standards.
- Current test coverage and whether the package has been validated against recent security guidelines.
- Compatibility with Python versions beyond 3.9, given the classifier list ends there.

## Package facts

- License: Apache Software License (permissive)
- Python support: unspecified
- Install friction: low
- Maintenance: dormant
- Downloads: 2.5M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

flask security headers, http security headers, xss protection flask, csrf protection, content security policy, https enforcement, flask security middleware, http-headers, flask-extension, web-security

[View on SkillFed](https://skillfed.io/packages/flask-talisman) · [View on PyPI](https://pypi.org/project/flask-talisman/)