How to Add Security Headers with Cloudflare

Add security headers with Cloudflare

If your site is proxied through Cloudflare (orange cloud), you can add security headers at the edge without touching your origin, using Transform Rules.

Managed Transforms (fastest)

Cloudflare ships one-click toggles under Rules → Transform Rules → Managed Transforms for common headers like X-Content-Type-Options: nosniff. Enable those first.

Custom headers via Transform Rules

For everything else, create an HTTP Response Header Modification rule (Rules → Transform Rules → Modify Response Header) and Set each header:

• X-Frame-Options → DENY
• Referrer-Policy → strict-origin-when-cross-origin
• Permissions-Policy → camera=(), microphone=(), geolocation=()
• Cross-Origin-Opener-Policy → same-origin
• X-XSS-Protection → 0

HSTS the safe way

Enable HSTS from SSL/TLS → Edge Certificates — Cloudflare warns you about the commitment and lets you set max-age and includeSubDomains from the UI. Only enable preload once every subdomain is HTTPS. See the HSTS guide.

Content Security Policy

Add Content-Security-Policy as another Set rule. Because CSP is site-specific, start with Content-Security-Policy-Report-Only and watch the reports before enforcing.

Verify

Scan your site with HeaderTest to confirm the edge headers are live. More: all header guides.