# OwaspHeaders.Core Passes 2 Million Downloads > OwaspHeaders.Core has passed two million downloads on NuGet. The first million took seven and a half years; the second took twenty-one months. *8 September 2026* · RJJ Software Leeds, UK. RJJ Software has announced that [OwaspHeaders.Core](https://www.nuget.org/packages/OwaspHeaders.Core/), its open-source security middleware for ASP.NET Core, has passed two million lifetime downloads on NuGet. The package stood at 2,026,881 downloads on 8th September 2026. Two million is a round number, and round numbers are easy to announce. The interval behind this one is the more useful figure. OwaspHeaders.Core took around seven and a half years to reach [its first million downloads in December 2024](/news/open-source-project-owaspheaders.core-reaches-1-million-downloads-celebrating-milestone-in-secure-web-development/). It took around twenty-one months to reach its second. ## Seven Years, Then Twenty-One Months The project began with a failure. In 2016, a penetration test on the first solo project Jamie Taylor had shipped at his then employer came back with pages of findings marked CRITICAL, almost all of them for HTTP headers he had never encountered. That report led him to the Open Worldwide Application Security Project (OWASP), then to a four-part blog series in 2017 explaining the ASP.NET Core middleware pipeline, and then to a NuGet package built out of the code in those posts. Seventy-nine published versions later, the adoption curve has steepened. When Taylor recorded a two-part account of the project for The Modern .NET Show in late June 2026, the package had been downloaded 1.7 million times. It has taken roughly ten weeks to add the next 325,000. None of that growth has been bought. There has never been a marketing budget behind OwaspHeaders.Core, and there is no commercial tier to upgrade to. The package is on its second million because teams that adopted it kept it, and because the problem it addresses has not gone away. ## What the Package Does OwaspHeaders.Core adds the security headers recommended by the [OWASP Secure Headers Project](https://owasp.org/www-project-secure-headers/) to an ASP.NET Core application, in a single line of configuration. Those Hypertext Transfer Protocol (HTTP) headers include Strict-Transport-Security, X-Frame-Options, X-Content-Type-Options and Referrer-Policy, each of which closes off a well-understood category of attack and none of which a new ASP.NET Core project sets on its own. Content-Security-Policy is a deliberate exception. The package ships no default value for it, because a content security policy that is correct for one application is close to useless for another, and a policy that silently breaks a site is worse than no policy at all. The reasoning behind the design is set out in [the original introduction to the project](/blog/introducing-owaspheaders-core-a-powerful-free-and-open-source-middleware-for-enhanced-security-in-asp-net-core-applications/). ## Still Under Active Development The package has shipped steadily through 2025 and 2026. Version 9.8 added [comprehensive logging support](/news/owaspheaders-core-9-8-introduces-comprehensive-logging-support-for-enhanced-security-visibility/), version 9.9 added [Clear-Site-Data header support](/news/owaspheaders.core-9.9-adds-clear-site-data-header-support-for-enhanced-security-control/), version 10.0.0 landed on 12th November 2025 alongside the general availability of .NET 10, and version 10.4.0 followed in May 2026. Maintenance activity extends past the release notes. The repository runs CodeQL analysis over every commit and currently holds an [OpenSSF Scorecard](https://scorecard.dev/viewer/?uri=github.com/GaProgMan/OwaspHeaders.Core) rating of 7.1, scored on 2nd September 2026. For a package that sits in the request pipeline of other people's production systems, that supply chain posture matters as much as the feature list; a point RJJ Software made at greater length after [January's reputation hijacking attempt on NuGet](/news/reputation-hijacking-attempt-on-nuget-what-package-owners-need-to-know/). Work on version 11 is underway and happening in the open, in [a public pull request](https://github.com/GaProgMan/OwaspHeaders.Core/pull/224) that anyone can read and build from. It adds support for .NET 11, removes the deprecated Expect-CT header entirely, migrates the test suite from xUnit v2 to v3, and moves off a version of Microsoft.OpenApi carrying a published advisory. The intention is to ship alongside .NET 11 rather than on a particular date, and the pull request remains open until the work behind it is finished. > [!NOTE] > Version 11 will remove support for .NET 8 and .NET 9. Teams on either version should stay on the 10.x line until they are ready to move to .NET 11. Version 10.4.0 remains available and supported in the meantime. ## Why RJJ Software Maintains It RJJ Software donates its chief technical officer's time to OwaspHeaders.Core, and has done since before the company had a website to announce it on. > Application security is something that I certainly didn't get taught in my formal education, and it's something that I've had to put in the time and effort to learn. I want to live in a world where "secure by default" is the easy path, and I feel like OwaspHeaders.Core is helping engineers to achieve that secure by default goal. > > — Jamie Taylor, CTO, RJJ Software That gap in formal education is not unique to him. Taylor has [written about why treating a penetration test as a final exam produces exactly this outcome](/blog/stop-treating-pentests-like-final-exams-why-security-cant-be-your-last-step/), and the two-part account he recorded for The Modern .NET Show covers both [the headers themselves](https://dotnetcore.show/season-8/from-pentest-to-1-7-million-downloads-part-1-the-headers-id-never-heard-of/) and [eight years of lessons from maintaining the package](https://dotnetcore.show/season-8/from-pentest-to-1-7-million-downloads-part-2-the-lessons-nobody-ever-taught-me/). The idea has occasionally travelled further than the .NET ecosystem. After a talk Taylor gave to [Chester Devs](https://chester.dev/) in January 2026, someone in the audience went away and built [the same thing for Go's Gin framework](https://github.com/flomation-co/gin-owasp-headers). Their README credits the talk with showing that "a relatively small amount of effort and HTTP Headers vastly improves the security posture of many Web Services". Taylor held Microsoft's Most Valuable Professional (MVP) award for Developer Technologies for four consecutive years, a tenure that concluded in 2026. The application security work that award recognised is the same work RJJ Software brings to client engagements. ## Get the Package OwaspHeaders.Core is free, open source, and available now: ```bash dotnet add package OwaspHeaders.Core ``` - [NuGet package](https://www.nuget.org/packages/OwaspHeaders.Core/) - [GitHub repository](https://github.com/GaProgMan/OwaspHeaders.Core) - [Documentation](https://gaprogman.github.io/OwaspHeaders.Core/) The documentation site also publishes [llms.txt](https://gaprogman.github.io/OwaspHeaders.Core/llms.txt) and [llms-full.txt](https://gaprogman.github.io/OwaspHeaders.Core/llms-full.txt) files. Point a coding agent at either and it can read the configuration options and worked examples directly, rather than working from whatever it happens to have memorised about the package. --- OwaspHeaders.Core is part of RJJ Software's commitment to open-source security tools that make the web safer for everyone. If your team needs an application security review, or help making secure defaults the easy path in your own codebase, [schedule a consultation](/schedule-consultation/).