---
id: secure
version: "2.0.1"
license: MIT
license_treatment: permissive
maintenance: active
---

# secure — A lightweight package that adds security headers for Python web frameworks.

License: permissive · Maintenance: active · Downloads: 2.1M/mo

## What it is and what it does

Secure centralizes HTTP security header management for Python web applications, replacing ad hoc header strings scattered across routes and middleware. Instead of copying header policy into view code, you configure one Secure instance with an opinionated preset (BALANCED, BASIC, or STRICT) and apply it consistently across all responses. The package handles Content-Security-Policy, Strict-Transport-Security, referrer policy, permissions policy, and browser protection headers.

It supports both synchronous and asynchronous response objects through a small public API and typed builders for custom policies. Middleware integrations for WSGI and ASGI let you apply headers app-wide rather than per-route. The package has no external dependencies and is fully typed, making it straightforward to integrate into existing frameworks.

Use it for:

- Apply HSTS, CSP, and referrer policies consistently across a web application via middleware.
- Tune specific security headers for compliance or hardening without rewriting header strings in every route.
- Start with BALANCED preset for a modern baseline and upgrade to STRICT when deploying a high-security application.
- Validate and normalize dynamically composed headers before emission to catch policy drift.
- Migrate legacy applications from ad hoc header code to a centralized, maintainable policy object.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Applies HTTP security headers to Python web responses through a single configurable object, supporting both WSGI and ASGI frameworks with preset policies and custom builder options.

Yes. Secure solves a real problem—header policy drift in web applications—with zero dependencies, active maintenance, and a clean API. The MIT license and support for current Python versions (3.10+) make it a low-risk addition. Install it if you manage HTTP security headers in any Python web framework; the preset defaults are sensible and the builder API scales to custom policies.

## Install

pip install secure
uv add secure
poetry add secure

## Installing secure

Before you install: Low friction: zero runtime dependencies, pure Python wheel, requires Python 3.10+. Active maintenance with recent release (114 days ago) and 1049 repository stars.

License in practice: MIT license permits unrestricted use, modification, and distribution in both open-source and proprietary projects with minimal obligations.

Quickstart:

pip install secure

from secure import Secure
from secure.middleware import SecureASGIMiddleware

secure_headers = Secure.with_default_headers()
# Apply via app.add_middleware(SecureASGIMiddleware, secure=secure_headers)

Requires Python 3.10 or later.

Verify before relying:

- Whether the package's header policies align with current OWASP or industry security recommendations.
- Performance overhead of header application at scale or in high-throughput scenarios.
- Coverage of emerging security headers beyond the three preset tiers.

## Package facts

- License: MIT (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 2.1M/month (top 5,000 on PyPI)
- Known vulnerabilities: none known

## Tags

HTTP security headers Python, HSTS CSP middleware, web security headers framework, secure response headers, security headers middleware, WSGI ASGI middleware security, content security policy builder, security-headers, middleware, web-framework

[View on SkillFed](https://skillfed.io/packages/secure) · [View on PyPI](https://pypi.org/project/secure/)