How to add security headers in Cloudflare

If your site already runs through Cloudflare, you can add security headers without touching your web server or your website's code. Cloudflare adds them to every response on the way out, and you can change or remove them from the dashboard at any time.

This guide sets up a starter set of six headers that suit most small business sites. Each one is low-risk for a typical site, and together they cover the six headers CyberVigil checks. The one that needs care is Content-Security-Policy, and there's a section on that below.

Will Cloudflare headers work for your site?

Only if your site's traffic goes through Cloudflare's proxy. Cloudflare's documentation says response changes like these only apply to DNS records set to Proxied, shown with an orange cloud. Records set to DNS only send visitors straight to your host, and Cloudflare never sees the response.

Open the DNS records for yourbusiness.com in Cloudflare and check the proxy status of the records for your site, usually the root domain and www.

If they say DNS only, check with your website platform before switching them. Some hosted platforms don't support Cloudflare's proxy:

• Wix says it doesn't support proxied DNS records for domain connections.
• Squarespace says it doesn't support third-party SSL providers such as Cloudflare.

On those platforms, use the platform's own settings instead. Our guides to Squarespace security settings and Wix security settings explain what each one lets you change.

Which headers should you add first?

Start with these six. They tell browsers to use HTTPS, stop other sites from framing your pages, and limit what your pages share or can access.

What each one does, in plain English:

• HSTS tells browsers to only ever load your site over HTTPS.
• X-Content-Type-Options stops browsers from guessing what kind of file they've received, which blocks a class of file-disguise tricks.
• X-Frame-Options lets only your own site show your pages inside a frame. This protects against clickjacking, where a fake page hides your site under its own buttons.
• Referrer-Policy sends other sites only your domain name, not the full address of the page a visitor came from.
• Permissions-Policy turns off camera, microphone and location access for your pages. Remove an item if your site uses it, for example a store locator that asks for location.
• The short Content-Security-Policy repeats the framing rule for newer browsers and upgrades any http:// images or scripts on your pages to https://.

How do I turn on HSTS in Cloudflare?

Use Cloudflare's built-in HSTS setting rather than a transform rule. Before you switch it on, make sure every page on your site loads over HTTPS. Turning on Always Use HTTPS, under SSL/TLS → Edge Certificates, sends any http:// visit to the secure version.

Then:

1. Go to SSL/TLS → Edge Certificates.
2. Under HTTP Strict Transport Security (HSTS), click Enable HSTS.
3. Read the warning dialog, select I understand, and click Next.
4. Turn on HSTS and set Max Age to 6 months or 12 months. CyberVigil looks for at least six months.
5. Leave Include subdomains off unless every subdomain, including ones used by other services, works over HTTPS.
6. Leave Preload off for now.
7. Turn on No-Sniff Header if you like. It adds X-Content-Type-Options: nosniff, so you can leave that header out of your transform rule.
8. Click Save.

HSTS is hard to undo quickly. Browsers remember it for the max age you chose. Cloudflare warns that once it's on, you shouldn't switch your site's records to DNS only, pause Cloudflare, move your nameservers away, or go back to plain HTTP. If you ever need to, set Max Age to 0 first and allow time for browsers to forget it.

How do I add the other headers with a Transform Rule?

A Response Header Transform Rule lets you set headers on every response from your site. Cloudflare's dashboard steps are:

1. In the Cloudflare dashboard, open the Rules overview page for your domain.
2. Click Create rule, then choose Response Header Transform Rule.
3. Give it a name you'll recognize later, such as "Security headers."
4. Under When incoming requests match, choose All incoming requests.
5. Under Modify response header, choose Set static, then enter X-Frame-Options as the header name and SAMEORIGIN as the value.
6. Click Set new header and repeat for Referrer-Policy, Permissions-Policy, Content-Security-Policy and, if you didn't use No-Sniff in the HSTS settings, X-Content-Type-Options.
7. Click Deploy.

The Set operation replaces any header with the same name that your server already sends, so you won't end up with duplicates. Cloudflare doesn't let rules change its own cf- headers or the server header.

What about Cloudflare's "Add security headers" option?

Cloudflare also has a one-click managed transform called "Add security headers." According to Cloudflare's reference, it sets X-Content-Type-Options, X-Frame-Options and a stricter Referrer-Policy value, plus two older headers. It doesn't add Content-Security-Policy or Permissions-Policy. If you use it, still add those two in your own rule, and decide which tool owns each header so you know where to change it later.

Check your headers after you deploy

Run a free scan to see which security headers your site sends now, along with your HTTPS setup, certificate and email records.

• Free check
• No signup
• No changes to your website

Get your free report in seconds.

Your website address

Check my website

How careful should you be with Content-Security-Policy?

Careful. A full Content-Security-Policy lists every place your pages are allowed to load scripts, styles, fonts and images from. Miss one, and something stops working: a booking widget, a payment form, your analytics. That's why the starter value above doesn't restrict scripts at all.

frame-ancestors 'self' controls who can put your site in a frame. MDN notes that frame-ancestors 'none' works much like X-Frame-Options DENY. In the same way, 'self' lines up with SAMEORIGIN, so the two headers in the starter set agree. upgrade-insecure-requests asks browsers to fetch http:// resources over HTTPS. If a resource isn't available over HTTPS, it won't load, so check your pages after deploying.

Testing a fuller policy

When you're ready for a stronger policy, test it with a Content-Security-Policy-Report-Only header first. Browsers check the policy and report what it would have blocked, without blocking anything. MDN notes the reports go to an address you set with the report-to directive. Without one, you can still see the warnings in your browser's developer console.

Add the report-only header as an extra row in the same transform rule. Keep the short enforced policy in place while you test. CyberVigil's check only counts an enforced Content-Security-Policy header, so a report-only header on its own won't clear that finding.

How do I check that the headers are working?

Give the rule a minute to take effect, then test from the outside.

1. Run the security headers checker on your site's address.
2. Open your site in a browser, then open the developer tools, select the Network tab, reload, click the first request, and look at the response headers.
3. Click through your key pages, such as the contact form, checkout or booking page, and confirm everything works.

If a header is missing, check three things. The DNS record may be set to DNS only. The rule may be saved as a draft instead of deployed. The rule's filter may not match the hostname you tested, for example www.yourbusiness.com instead of yourbusiness.com.

If something breaks, open the rule in the dashboard and remove the header causing it, or turn the rule off. Visitors get the change on their next page load. HSTS is the exception, for the reasons covered above.

What should you do next?

Start with HSTS and the transform rule today. Leave a fuller Content-Security-Policy for later, once the starter set has run for a while without problems.

1. Run the free security headers checker to confirm all six headers are in place.
2. Read the HSTS fix guide if your report still flags HSTS.
3. Run a full website security scan to check your certificate, TLS versions and email records too.