How to Add Security Headers with Cloudflare
Add CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy to Cloudflare. Copy-paste configuration included.
The 6 Essential Security Headers
Content-Security-Policy (CSP)
Controls which sources of scripts, styles, and resources are allowed. Prevents XSS by blocking inline scripts and unauthorized external scripts.
Strict-Transport-Security (HSTS)
Forces browsers to always use HTTPS, preventing protocol downgrade attacks and cookie hijacking over HTTP.
X-Frame-Options
Prevents your page from being loaded in an iframe, blocking clickjacking attacks.
X-Content-Type-Options
Prevents browsers from MIME-sniffing the content type, stopping attacks that rely on content type confusion.
Referrer-Policy
Controls how much referrer information is sent with requests, protecting user privacy and preventing information leakage.
Permissions-Policy
Controls which browser features (camera, microphone, geolocation) your page can use, reducing attack surface.
Cloudflare Configuration
Add this to Cloudflare Dashboard → Workers → Create Worker, or Rules → Transform Rules → Modify Response Header:
// Cloudflare Worker for security headers
export default {
async fetch(request) {
const response = await fetch(request);
const newHeaders = new Headers(response.headers);
newHeaders.set('X-Frame-Options', 'DENY');
newHeaders.set('X-Content-Type-Options', 'nosniff');
newHeaders.set('Strict-Transport-Security', 'max-age=63072000; includeSubDomains; preload');
newHeaders.set('Referrer-Policy', 'strict-origin-when-cross-origin');
newHeaders.set('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
newHeaders.set('Content-Security-Policy', "default-src 'self'; script-src 'self';");
return new Response(response.body, {
status: response.status,
headers: newHeaders,
});
},
};Cloudflare Transform Rules (free plan) can add headers without Workers. Go to Rules → Transform Rules → Create Rule → Modify Response Header. Workers give more control but require Workers plan.
How to Test Your Headers
curl -I https://yourdomain.comOr use Cybrove's free security check to automatically validate all security headers and get specific fix recommendations.
Frequently Asked Questions
How do I add security headers to Cloudflare?
Add security headers to Cloudflare by modifying Cloudflare Dashboard → Workers → Create Worker, or Rules → Transform Rules → Modify Response Header. The essential headers are CSP, HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, and Permissions-Policy. See the configuration example above.
How do I test if my Cloudflare security headers are working?
Run: curl -I https://yourdomain.com and check the response headers. Or use Cybrove's free security check at cybrove.com/scan which automatically validates all security headers and reports which are missing.
Which security headers are most important for Cloudflare?
CSP (prevents XSS), HSTS (forces HTTPS), and X-Frame-Options (prevents clickjacking) are the most critical. X-Content-Type-Options and Referrer-Policy provide additional protection with minimal configuration effort.
Check if your Cloudflare headers are configured correctly
Free security check validates all 6 headers plus SSL, DNS, and email authentication.
Free Security Check