Where does the _headers file go in my project?

Place it at the root of your Pages build output directory (the folder you configured as the build output, not necessarily your repo root), alongside index.html. Cloudflare Pages picks it up automatically on deploy, no build step required.

What happens if two rules match the same request and set the same header?

Cloudflare applies every rule whose path pattern matches, but when two matching rules set the same header name, the more specific path pattern wins over a more general one (for example /blog/* over /*). Rules that set different header names on overlapping paths are all applied together.

Can I use this for security headers like CSP or HSTS?

Yes, any header name/value pair works here. If you only want a curated set of common security headers with sensible defaults, the dedicated Cloudflare Pages Security Headers Generator in this same category gives you a faster starting point.

Does this tool validate my header values are syntactically correct?

It validates that each rule has a path starting with "/" and at least one header with a non-empty name, but it doesn't parse or validate the semantics of values like a CSP directive string, that's on you to get right for the specific header.

Cloudflare _headers Generator - Build a Pages Headers File

Overview

Introduction

Cloudflare Pages reads a plain-text _headers file at deploy time to attach custom response headers to matching paths, but hand-writing its specific two-space-indented syntax and remembering how overlapping rules resolve is easy to get subtly wrong.

This tool builds that file from a list of path patterns, each with its own header rows, and outputs it in the exact format Cloudflare's Pages headers parser expects.

What Is Cloudflare Pages _headers File Generator?

A form-based generator for Cloudflare Pages' _headers file: you add one or more path-pattern rules (like /* or /api/*), and under each, one or more header name/value pairs.

The output is plain text, ready to save as _headers in your Pages build output directory exactly as-is.

How Cloudflare Pages _headers File Generator Works

Each rule you add becomes a path-pattern line followed by its header lines indented with two spaces, the syntax Cloudflare's Pages build pipeline parses when it deploys your site.

A comment block at the top of the output explains the one non-obvious behavior worth remembering: when multiple rules match the same request and set the same header name, the more specific path pattern's value wins.

When To Use Cloudflare Pages _headers File Generator

Use it when setting up caching headers, security headers, or CORS headers for a Cloudflare Pages project without memorizing the _headers syntax from scratch.

It's also useful for reviewing an existing headers setup, build the rules here and diff the output against what's currently deployed.

Often used alongside Cloudflare Pages Security Headers Generator, Cloudflare Pages Caching Rule Generator and Cloudflare Pages CSP Header Generator.

Features

Advantages

Outputs the exact syntax Cloudflare Pages expects, no manual indentation or formatting to get wrong.
Supports any number of path rules and any number of headers per rule.
Includes a precedence reminder directly in the generated file as a comment, so future editors don't have to look it up.

Limitations

Doesn't validate the semantic correctness of header values (a malformed CSP string will still be accepted), only that a name and value are present.
Doesn't deploy or upload the file anywhere, you still need to place the generated text at the root of your Pages build output.

Examples

A cache rule for static assets plus a global security header

Input

rule 1: path /assets/*, header Cache-Control: public, max-age=31536000, immutable; rule 2: path /*, header X-Content-Type-Options: nosniff

Output

/assets/*
  Cache-Control: public, max-age=31536000, immutable

/*
  X-Content-Type-Options: nosniff

Both rules apply to any request under /assets/*, since /* also matches; only /assets/* sets Cache-Control, and only /* sets X-Content-Type-Options, so both headers end up on the response.

Best Practices & Notes

Best Practices

Put your most specific path patterns first conceptually (even though file order doesn't affect precedence) so the rule list reads top-to-bottom from narrow to broad.
Keep a single /* catch-all rule for headers you want everywhere, and only add narrower rules for genuine exceptions.
Re-deploy and check response headers with your browser's network tab after any change, Cloudflare's actual precedence behavior is the ultimate source of truth.

Developer Notes

Cloudflare Pages' _headers parser expects each rule as an un-indented path pattern line followed by one or more two-space-indented `Name: Value` lines, with a blank line separating rules; this generator reproduces that layout exactly and trims any rule whose path or every header is empty rather than emitting invalid blocks.

Cloudflare Pages _headers File Generator Use Cases

Setting cache-control policy per asset type on a new Cloudflare Pages project
Rolling out a consistent security header set across every route
Documenting an existing _headers setup by reconstructing it rule by rule

Common Mistakes

Forgetting that header lines must be indented; an un-indented line is parsed as a new path pattern instead of a header.
Assuming file order determines precedence when two rules conflict, it's path specificity that wins, not order.

Tips

Use the Cloudflare Pages Security Headers Generator first for a solid security-header baseline, then add project-specific caching rules here on top of it.

Cloudflare Pages _headers File Generator