How is this different from the general _headers File Generator?

The general _headers generator lets you build any arbitrary path/header combination from scratch. This tool is narrower and faster: it's pre-configured with only the well-known security headers, each with a sensible default value, so you can produce a solid security baseline in a few clicks instead of typing every header name and value by hand.

What does the CSP report-only toggle actually change?

When enabled, the policy is sent as Content-Security-Policy-Report-Only instead of Content-Security-Policy. The browser evaluates the policy and can report violations, but never blocks anything, which is the standard way to test a new CSP against real traffic before enforcing it.

Why would I turn X-Frame-Options off?

If your CSP already includes a frame-ancestors directive, it supersedes X-Frame-Options in modern browsers, and you might intentionally allow framing from specific origins that X-Frame-Options's blunter DENY/SAMEORIGIN values can't express. The "none" option omits the header entirely for that case.

Is the default HSTS max-age safe to use immediately?

A long max-age (this tool defaults to one year) tells browsers to remember to always use HTTPS for that long, which is safe as long as your site reliably serves HTTPS. Only enable includeSubDomains and preload once you're confident every subdomain also supports HTTPS, since preload in particular is very hard to reverse quickly.

Cloudflare Pages Security Headers

Overview

Introduction

Rolling out a solid security header baseline on a new Cloudflare Pages project usually means looking up the same half-dozen headers and their recommended values every single time.

This tool skips that lookup: it's pre-loaded with sensible defaults for HSTS, CSP, Referrer-Policy, X-Content-Type-Options, X-Frame-Options, and Permissions-Policy, and outputs the exact _headers snippet to paste in.

What Is Cloudflare Pages Security Headers Generator?

A focused _headers generator covering only the commonly recommended security response headers, each with a toggle or default value rather than a blank field, so getting a reasonable baseline takes seconds.

It includes a report-only toggle for CSP specifically, since rolling out a new Content-Security-Policy safely almost always starts in report-only mode.

How Cloudflare Pages Security Headers Generator Works

Each header is built independently from its own toggle/value and only included in the output if enabled or non-empty, so unused headers don't clutter the generated snippet.

The CSP report-only toggle simply swaps the emitted header name between Content-Security-Policy and Content-Security-Policy-Report-Only, everything else about how the policy string is written stays the same.

When To Use Cloudflare Pages Security Headers Generator

Use it when standing up a new Cloudflare Pages project and you want a solid security-header starting point without researching each header individually.

It's also useful for auditing an existing project's headers, toggle through the options here and compare against what's actually deployed.

Often used alongside Cloudflare Pages _headers File Generator, Cloudflare Pages CSP Header Generator and HTTP Security Headers Generator.

Features

Advantages

Pre-filled with sensible, commonly recommended defaults (a one-year HSTS max-age, nosniff, SAMEORIGIN) so you're not starting from a blank slate.
Keeps the output minimal, only headers you've enabled or given a value appear in the generated snippet.
The CSP report-only toggle makes it easy to generate a safe testing version before switching to full enforcement.

Limitations

Only outputs the _headers snippet for the single path pattern you specify (defaulting to /*), for multiple different rules per path use the general _headers Generator.
Doesn't validate that your CSP value string is syntactically correct, only that it's non-empty, use the dedicated CSP Generator to build that string carefully.

Examples

Default security headers for the whole site

Input

path: /*, HSTS: enabled (max-age 31536000, includeSubDomains), Referrer-Policy: strict-origin-when-cross-origin, X-Frame-Options: SAMEORIGIN

Output

/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains
  Referrer-Policy: strict-origin-when-cross-origin
  X-Content-Type-Options: nosniff
  X-Frame-Options: SAMEORIGIN

Each enabled header appears as its own indented line under the /* path pattern, ready to paste into a Cloudflare Pages _headers file.

Best Practices & Notes

Best Practices

Roll out a new CSP in report-only mode first, review actual violation reports or console warnings, then switch to enforced once you're confident it's not breaking anything.
Only enable HSTS preload after you've confirmed every subdomain serves valid HTTPS, since preload list removal can take months to propagate across browsers.
Pair X-Content-Type-Options: nosniff with correct Content-Type headers on all your assets, it prevents MIME-sniffing but doesn't fix a genuinely wrong content type.

Developer Notes

Output is a single Cloudflare Pages _headers rule block for one path pattern; each header line is only emitted when its corresponding toggle is on or its value field is non-empty, keeping the generated snippet limited to headers you've deliberately chosen rather than emitting a fixed template with commented-out lines.