---
id: secweb
version: "2.0.0"
license: MPL-2.0
license_treatment: copyleft
maintenance: active
---

# Secweb — Secweb is a pack of security middlewares for fastApi and starlette servers it includes CSP, HSTS, and many more

License: copyleft · Maintenance: active · Downloads: 361.2K/mo

## What it is and what it does

Secweb is a middleware package that automatically injects security headers into Starlette-based application responses. It provides 16 security headers including Content-Security-Policy, HTTP Strict Transport Security, X-Frame-Options, and others, with sensible defaults aligned to MDN and OWASP recommendations. You can use it as a single SecWeb class that applies all headers at once, or import individual header functions to apply only what you need. Headers are customizable via an options dictionary, and some support advanced features like nonce generation for inline scripts and styles, or report-only modes for testing policies without enforcement.

The package has no external runtime dependencies beyond Starlette itself, making it lightweight to add to existing projects. Configuration is minimal—often just a single line—but flexible enough to disable specific headers or override defaults. It targets Python >= 3.10 and is actively maintained.

Use it for:

- Add CSP, HSTS, and clickjacking protection to a Starlette application in one call without writing middleware boilerplate.
- Gradually roll out a Content-Security-Policy by enabling report-only mode to collect violations before enforcing.
- Generate per-request nonces for inline scripts and styles in a template route to allow CSP while keeping inline code.
- Protect a Starlette application with security headers when you cannot or do not want to use a reverse proxy.
- Customize individual security policies (e.g., set HSTS max-age or Cache-Control directives) while keeping others at defaults.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Secweb applies security headers (CSP, HSTS, X-Frame-Options, and 13 others) to FastAPI and Starlette applications with minimal configuration and no external runtime dependencies.

Yes. Secweb is worth installing if you use Starlette and want security headers without external dependencies or complex configuration. It is actively maintained, has no known vulnerabilities, and offers both simplicity (one-line setup) and flexibility (per-header customization). The MPL-2.0 license is permissive for use; only modifications to the package itself trigger copyleft obligations. The main consideration is the Python >= 3.10 requirement.

## Install

pip install secweb
uv add secweb
poetry add secweb

## Installing Secweb

Before you install: Low install friction: pure Python wheel with no runtime dependencies. Active maintenance with a recent release (15 days old) and steady repository activity.

License in practice: Licensed under MPL-2.0 (copyleft). You must disclose source code modifications and distribute under the same license if you modify the package itself, though using it unmodified in your application does not trigger these obligations.

Quickstart:

pip install Secweb

from Secweb import SecWeb

SecWeb(app=app)

Requires Python >= 3.10 and Starlette.

Verify before relying:

- Whether the 16 headers listed in the description are all implemented in version 2.0.0 or if some (like PermissionsPolicy) remain in development.
- Whether nonce generation for CSP is cryptographically sound and suitable for production use.
- Whether the package works with frameworks other than those built on Starlette.

## Package facts

- License: MPL-2.0 (copyleft)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 361.2K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

starlette security headers, csp middleware, http security headers, content security policy, hsts strict transport security, x-frame-options middleware, security header middleware, starlette-middleware, http-security

[View on SkillFed](https://skillfed.io/packages/secweb) · [View on PyPI](https://pypi.org/project/secweb/)