Cloudflare Security Headers Generator
Generate Cloudflare security header configurations using either Cloudflare Workers (maximum control) or Cloudflare Transform Rules (no code required). Both approaches let you add security headers at the CDN edge without modifying your origin server.
What is ?
Cloudflare sits in front of your origin server as a reverse proxy and CDN. This position allows Cloudflare to add, modify, or remove HTTP response headers before they reach the user's browser. Security headers can be deployed at the Cloudflare edge using Workers (a serverless JavaScript environment) or Transform Rules (a no-code dashboard feature), meaning you can secure sites even when you have no access to the origin server configuration.
Why It Matters
Many organizations host applications on platforms where direct server configuration is restricted (SaaS platforms, legacy systems, shared hosting with no SSH access). Cloudflare's header injection capability allows security teams to implement browser-enforced security controls regardless of what the origin server does. This is particularly valuable for securing legacy applications that cannot be modified.
Common Configuration Mistakes
- ✗Setting HSTS via Cloudflare Worker on HTTP URLs (HSTS only works on HTTPS)
- ✗Using Transform Rules to add CSP but forgetting to test for breakage
- ✗Adding headers via both Worker and Transform Rules, causing duplicate headers
- ✗Forgetting that Workers incur latency if not deployed at edge locations near users
- ✗Not enabling "Always Use HTTPS" in Cloudflare SSL/TLS settings before adding HSTS
Recommended Configuration
// Cloudflare Worker
addEventListener('fetch', event => {
event.respondWith(handleRequest(event.request));
});
async function handleRequest(request) {
const response = await fetch(request);
const newResponse = new Response(response.body, response);
newResponse.headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains; preload');
newResponse.headers.set('X-Frame-Options', 'SAMEORIGIN');
newResponse.headers.set('X-Content-Type-Options', 'nosniff');
newResponse.headers.delete('X-Powered-By');
return newResponse;
}Frequently Asked Questions
Should I use Cloudflare Workers or Transform Rules for security headers?
Transform Rules are simpler and sufficient for most use cases — no code required. Use Workers when you need conditional logic (e.g., different CSP for different paths) or when you're already using a Worker for other purposes.
Can Cloudflare add HSTS for me?
Yes, via the SSL/TLS → Edge Certificates → HTTP Strict Transport Security (HSTS) setting in the Cloudflare dashboard. This is the easiest way to add HSTS. Or add it via Worker/Transform Rules.
Will Cloudflare security headers affect my origin server's headers?
Headers set via Cloudflare Workers or Transform Rules are added at the edge — your origin's headers are passed through, and Cloudflare either adds to or overrides them. If both Cloudflare and your origin set the same header, the Cloudflare value takes precedence if you use "set" (overwrite) mode.
Related Tools & Guides
Need Professional Web Application Security Testing?
This scanner checks visible headers. VAPT Experts provides professional web application penetration testing, API security testing, and compliance-ready security reports.
Request VAPT Assessment