PHP download

Download the PHP package jeffersongoncalves/filament-security-headers without Composer

On this page you can find all versions of the php package jeffersongoncalves/filament-security-headers. It is possible to download/install these versions without Composer. Possible dependencies are resolved automatically.

Table of contents
Download jeffersongoncalves/filament-security-headers
More information about jeffersongoncalves/filament-security-headers
Files in jeffersongoncalves/filament-security-headers

Vendor jeffersongoncalves
Package filament-security-headers
Short Description Filament settings page for laravel-security-headers: edit the Content Security Policy, response headers and HSTS from the panel, with a report-only mode to try a policy before enforcing it.
License MIT
Homepage https://github.com/jeffersongoncalves/filament-security-headers

Keywords laravel csp content-security-policy hsts security-headers filament filament-plugin jeffersongoncalves spatie-laravel-settings filament-security-headers

FAQ

After the download, you have to make one include require_once('vendor/autoload.php');. After that you have to import the classes with use statements.

Example:

If you use only one package a project is not needed. But if you use more then one package, without a project it is not possible to import the classes with use statements.

In general, it is recommended to use always a project to download your libraries. In an application normally there is more than one library needed.

Some PHP packages are not free to download and because of that hosted in private repositories. In this case some credentials are needed to access such packages. Please use the auth.json textarea to insert credentials, if a package is coming from a private repository. You can look here for more information.

Some hosting areas are not accessible by a terminal or SSH. Then it is not possible to use Composer.
To use Composer is sometimes complicated. Especially for beginners.
Composer needs much resources. Sometimes they are not available on a simple webspace.
If you are using private repositories you don't need to share your credentials. You can set up everything on our site and then you provide a simple download link to your team member.
Simplify your Composer build process. Use our own command line tool to download the vendor folder as binary. This makes your build process faster and you don't need to expose your credentials for private repositories.

Please rate this library. Is it a good library?

Example code of jeffersongoncalves/filament-security-headers

Informations about the package filament-security-headers

![Filament Security Headers](https://raw.githubusercontent.com/jeffersongoncalves/filament-security-headers/3.x/art/jeffersongoncalves-filament-security-headers.png)

Filament Security Headers

A Filament settings page for jeffersongoncalves/laravel-security-headers: edit the Content Security Policy, the response headers and HSTS from the panel instead of a config change and a deploy.

CSP directives as key/value pairs, the {nonce} placeholder included, plus the report URI
Report-only mode to try a new policy (Content-Security-Policy-Report-Only) before enforcing it
Response headers (X-Frame-Options, Referrer-Policy, Permissions-Policy...): edit, add, or leave a value empty to drop one
HSTS: on/off, max-age, subdomains, preload
Reset to config at any time

Until the page is saved, nothing changes: the middleware keeps using config/security-headers.php, and the page opens with those values. Header and directive names are validated and line breaks are rejected (no response splitting).

Compatibility

Branch	Filament	Package version
1.x	3.x	`^1.0`
2.x	4.x	`^2.0`
3.x	5.x	`^3.0`

Installation

Set up laravel-security-headers first (the SecurityHeaders middleware on your routes).

Usage

The saved values are read once per request (one settings query; enable the spatie/laravel-settings cache to skip it). The header is built on every request — including pages served by a full-page cache such as laravel-page-cache — so a saved change applies right away; flushing the page cache does not change it.

Tightening the policy safely

Turn on report-only, change the directive (e.g. swap 'unsafe-inline' for 'nonce-{nonce}' in script-src) and save.
Browse the site and watch the browser console: report-only logs every violation without blocking anything.
Fix what violates (inline scripts without the nonce, Alpine expressions that need 'unsafe-eval' — see Nonces and Alpine.js / Livewire without 'unsafe-eval'), then turn report-only off.

If something breaks after enforcing, put the old value back (or Reset to config) — no deploy needed. Proxies may also add scripts of their own (e.g. Cloudflare's Google tag gateway injects inline GTM without the nonce); check the page as a real browser receives it.

Requirements

PHP 8.2 or higher
Filament 5.x
jeffersongoncalves/laravel-security-headers 2.x

Changelog

Please see CHANGELOG for more information on what has changed recently.

Contributing

Please see CONTRIBUTING for details.

Security Vulnerabilities

Please review our security policy on how to report security vulnerabilities.

Credits

Jefferson Gonçalves
All Contributors

License

The MIT License (MIT). Please see License File for more information.

All versions of filament-security-headers with dependencies

PHP Build Version

Package Version

Version 3.0.0 Release 09. Oct 2026
create-project require 0 people chose require and
0 people chose create-project.

Download

Download latest version of filament-security-headers from vendor jeffersongoncalves

Requires php Version ^8.2
filament/filament Version ^5.3
filament/spatie-laravel-settings-plugin Version ^5.3
jeffersongoncalves/laravel-security-headers Version ^2.0
spatie/laravel-package-tools Version ^1.16
spatie/laravel-settings Version ^3.0

Composer command for our command line client (download client) This client runs in each environment. You don't need a specific PHP version etc. The first 20 API calls are free. Standard composer command

The package jeffersongoncalves/filament-security-headers contains the following files

Loading the files please wait ...