Cloudflare _headers Generator

Generate Cloudflare Pages _headers files for security headers, caching, CSP, HSTS, framework output folders, and static deployment.

Output:A ready-to-use configuration file for Cloudflare _headers with best practices applied.

Quick Summary

Use a Cloudflare _headers Generator when you need a correctly formatted _headers file for Cloudflare Pages security headers, caching rules, CSP, noindex headers, or framework-specific output folders.

What is this tool?

The Cloudflare _headers file is a plain text file that tells Cloudflare Pages which HTTP headers to append to responses matching specific URL patterns.

It's the primary way to inject strict security policies, optimize browser caching for static assets, and control indexing for staging environments when deploying static sites.

How to Use This Tool

Select your framework (Next.js, React, Astro, etc.) so we can tell you where to put the file.
Enable common security headers like HSTS and X-Content-Type-Options.
Configure cache settings for static assets or APIs.
Copy the generated code and place it in the recommended folder.

What This Tool Generates

_headers — The fully configured headers file.

Best Practices

Always apply security headers globally to '/*' and override them for specific paths if necessary.
Use immutable caching for hashed static assets (like JS and CSS chunks) to maximize performance.
Check your framework's documentation; some frameworks will automatically copy files from a 'public' directory to the build output.

Common Mistakes

Placing the _headers file in the project root instead of the framework's designated public folder, causing it to be ignored.
Adding HSTS preload without being completely certain all subdomains can support HTTPS.
Relying on _headers for dynamic SSR routes when using Cloudflare Workers (you should handle headers in the Worker logic instead).

Security Notes

Do not add random security headers blindly. Test headers like Content-Security-Policy in report-only mode first to avoid breaking iframes, analytics, or external assets.
If you are deploying a staging site to a custom domain, consider using X-Robots-Tag: noindex to prevent search engines from crawling it.

Frequently Asked Questions

What is a Cloudflare _headers file?

A _headers file allows you to define custom HTTP response headers for your Cloudflare Pages project. It can be used to set security headers like CSP and HSTS, or to add Cache-Control headers to specific routes.

Where do I put _headers in Cloudflare Pages?

It depends on your framework. For Next.js static exports, it goes in public/. For React/Vite, it also goes in public/. During the build, it is usually copied to the output folder like out/ or dist/, which Cloudflare Pages reads.

Does _headers work with Next.js?

Yes, if you use output: 'export'. However, if you are using Next.js SSR (e.g., via OpenNext), the static _headers file may not apply to dynamic routes, and you should handle headers via Next.js middleware.

How do I add security headers in Cloudflare Pages?

You can add security headers by creating a rule in your _headers file that matches all routes (/*), and assigning headers like X-Content-Type-Options: nosniff and X-Frame-Options: DENY.

Can I add cache headers with _headers?

Yes, you can specify Cache-Control headers for specific assets, like /assets/* Cache-Control: public, max-age=31536000, immutable.

How We Keep Your Configs Safe & Valid

Built-in Error Checking

Every file is checked against official rules. We catch missing fields and bad syntax. YAML indentation errors are flagged right away. Kubernetes, Terraform, and Docker specs are all covered. API versions and labels are verified too. You get valid output every time you generate.

100% Private & Local

All tools run in your browser only. Your API keys never leave your machine. We do not use any tracking scripts. No data is sent to any server. Passwords and secrets stay on your device. Crypto operations use the Web Crypto API. Your privacy is fully protected at all times.

Secure Settings by Default

Configs use safe defaults out of the box. Containers run as non-root users. Root filesystems are set to read-only. Dangerous Linux capabilities are dropped. Network policies limit pod-to-pod traffic. TLS 1.3 is enabled for web servers. Security headers are added where needed.

Ready for CI/CD & Git

Output files are ready for your Git repo. Use them with ArgoCD, Flux, or GitHub Actions. Files use clear formatting and comments. Code review is easy for your team. Indentation and key order are consistent. Test in staging before going to production. Every file is clean and well-structured.

Infrastructure as Code

Store configs in Git alongside your code. Terraform modules include typed variables. Backend configs support remote state locking. Outputs work across multiple modules. Ansible playbooks use clear task steps. Chef and Puppet configs are also supported. Every file works with version control tools.

Monitoring & Tracing

Set up Prometheus with auto-discovery rules. Create Grafana dashboards with template variables. Add alerting rules with severity labels. Use OpenTelemetry for trace collection. Forward logs to Loki or Elasticsearch. Connect to Jaeger or Tempo for tracing. Monitor metrics, logs, and traces together.

Container & Docker Safety

Dockerfiles use multi-stage builds for small images. Base images are pinned to exact versions. Dev files are excluded from final images. Health checks are added for orchestrator use. Containers switch to non-root users. Docker Compose uses named volumes and networks. Resource limits are set in deploy configs.

Multiple Output Formats

Export as YAML, JSON, HCL, or TOML. Kubernetes uses YAML with proper separators. Terraform uses HCL with correct escaping. JSON output has consistent indentation. Copy to clipboard with one click. Preview output with syntax highlighting. Line numbers help you review quickly.