ConfigGenerator

Cloudflare Pages Security Headers Generator

Generate Cloudflare Pages security headers including CSP, HSTS, Referrer-Policy, X-Content-Type-Options, Permissions-Policy, and frame controls.

Output:A ready-to-use configuration file for Cloudflare Pages Security Headers with best practices applied.

Security Presets

File Location

Where to place your _headers

Source Repository
public/_headers
After Build
out/_headers
  • •Next.js server-side redirects in next.config.ts do not work for static export on Cloudflare Pages.
  • •Use output: 'export' in your Next.js config.
  • •Place _headers in the public directory before building.
  • •Cloudflare Pages should deploy the 'out' directory.
Security Warnings
  • HSTS preload or includeSubDomains is active. Ensure all subdomains support HTTPS before deploying to production.
Score: 65/100
/*
  X-Content-Type-Options: nosniff
  X-Frame-Options: SAMEORIGIN
  Referrer-Policy: strict-origin-when-cross-origin
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  Permissions-Policy: camera=(), microphone=(), geolocation=(), browsing-topics=()

Quick Summary

Use the Cloudflare Pages Security Headers Generator to create a highly secure _headers file that protects your static site from clickjacking, MIME-type sniffing, cross-site scripting (XSS), and unwanted framing.

What is this tool?

Unlike traditional servers where you might configure Nginx or Apache, Cloudflare Pages relies on a _headers file to append HTTP response headers.

Security headers instruct the browser on how to behave when handling your site's content, significantly mitigating the risk of client-side vulnerabilities.

How to Use This Tool

  1. Select your framework (Next.js, Astro, etc.) to get the correct output path.
  2. Choose a preset (Safe Default or Strict Mode).
  3. Enable or disable specific policies like HSTS, CSP, and X-Frame-Options.
  4. Review the warnings before deploying, especially for HSTS preload.
  5. Copy the generated _headers content into your project.

What This Tool Generates

  • _headers — Pre-configured with the most effective security headers.

Best Practices

  • Use 'Safe Default' if you are unsure; it provides strong protection with a very low risk of breaking your site.
  • Always set X-Content-Type-Options to 'nosniff' to prevent browsers from interpreting non-executable files as scripts.
  • Use Permissions-Policy to explicitly block access to powerful APIs like the camera or microphone if your site doesn't need them.

Common Mistakes

  • Enabling HSTS 'preload' without ensuring every single subdomain you own (even internal ones) supports HTTPS. This can permanently break access to non-HTTPS subdomains.
  • Implementing a strict enforcing CSP without checking if third-party analytics (like Google Analytics) or fonts are blocked.
  • Adding security headers to only specific routes instead of applying them globally to '/*'.

Security Notes

  • Test your site using Mozilla Observatory or SecurityHeaders.com after deploying these changes to Cloudflare Pages.
  • If you use inline scripts (like Google Tag Manager), you may need to adjust your CSP to use nonces or hashes, or temporarily rely on 'unsafe-inline'.

Frequently Asked Questions

Which security headers should I use on Cloudflare Pages?
At a minimum, you should use X-Content-Type-Options (nosniff), Referrer-Policy, and X-Frame-Options (or CSP frame-ancestors). HSTS and Content-Security-Policy (CSP) are highly recommended but require more careful testing.
How do I add HSTS in Cloudflare Pages?
You add 'Strict-Transport-Security: max-age=31536000; includeSubDomains' to your _headers file under the '/*' route to enforce HTTPS for all visitors.
Should I use CSP report-only first?
Yes! A strict Content Security Policy can break your scripts, fonts, analytics, and images if configured incorrectly. Always deploy Content-Security-Policy-Report-Only first to identify what breaks.
Does X-Frame-Options still matter?
Yes, although modern browsers prefer the CSP frame-ancestors directive, X-Frame-Options provides fallback protection against clickjacking for older browsers.
What is Permissions-Policy?
Permissions-Policy (formerly Feature-Policy) allows you to control which browser features (like camera, microphone, geolocation) can be used on your site. Setting it to camera=(), microphone=() disables those features entirely, reducing your attack surface.

How We Keep Your Configs Safe & Valid

Built-in Error Checking

Every file is checked against official rules. We catch missing fields and bad syntax. YAML indentation errors are flagged right away. Kubernetes, Terraform, and Docker specs are all covered. API versions and labels are verified too. You get valid output every time you generate.

100% Private & Local

All tools run in your browser only. Your API keys never leave your machine. We do not use any tracking scripts. No data is sent to any server. Passwords and secrets stay on your device. Crypto operations use the Web Crypto API. Your privacy is fully protected at all times.

Secure Settings by Default

Configs use safe defaults out of the box. Containers run as non-root users. Root filesystems are set to read-only. Dangerous Linux capabilities are dropped. Network policies limit pod-to-pod traffic. TLS 1.3 is enabled for web servers. Security headers are added where needed.

Ready for CI/CD & Git

Output files are ready for your Git repo. Use them with ArgoCD, Flux, or GitHub Actions. Files use clear formatting and comments. Code review is easy for your team. Indentation and key order are consistent. Test in staging before going to production. Every file is clean and well-structured.

Infrastructure as Code

Store configs in Git alongside your code. Terraform modules include typed variables. Backend configs support remote state locking. Outputs work across multiple modules. Ansible playbooks use clear task steps. Chef and Puppet configs are also supported. Every file works with version control tools.

Monitoring & Tracing

Set up Prometheus with auto-discovery rules. Create Grafana dashboards with template variables. Add alerting rules with severity labels. Use OpenTelemetry for trace collection. Forward logs to Loki or Elasticsearch. Connect to Jaeger or Tempo for tracing. Monitor metrics, logs, and traces together.

Container & Docker Safety

Dockerfiles use multi-stage builds for small images. Base images are pinned to exact versions. Dev files are excluded from final images. Health checks are added for orchestrator use. Containers switch to non-root users. Docker Compose uses named volumes and networks. Resource limits are set in deploy configs.

Multiple Output Formats

Export as YAML, JSON, HCL, or TOML. Kubernetes uses YAML with proper separators. Terraform uses HCL with correct escaping. JSON output has consistent indentation. Copy to clipboard with one click. Preview output with syntax highlighting. Line numbers help you review quickly.

Related Tools

Cloudflare CSP Generator

A deeper, more granular tool specifically for building complex Content Security Policies.

Security Headers Generator

Generic security headers generator for Apache/Nginx.