How to Fix Security Headers via Cloudflare

If your site is behind Cloudflare, you can add every security header our Security Audit checks for at the edge — without touching your origin server. Cloudflare Transform Rules apply the headers at every PoP globally; Cloudflare's SSL/TLS dashboard handles HSTS and TLS configuration. This guide covers the full set: six HTTP security headers, modern TLS, security.txt, all configured from the Cloudflare dashboard.

1. Enable HSTS via the SSL/TLS dashboard

Cloudflare has a dedicated HSTS toggle that handles the header globally — don't add HSTS via Transform Rules, use the dedicated control.

2. Add the other five headers via Transform Rules

X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and Content-Security-Policy all go into a single Transform Rule for clean management.

X-Frame-Options              SAMEORIGIN
X-Content-Type-Options       nosniff
Referrer-Policy              strict-origin-when-cross-origin
Permissions-Policy           geolocation=(), microphone=(), camera=()
Content-Security-Policy      default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; frame-ancestors 'self'

3. Configure minimum TLS version

4. Serve security.txt

Cloudflare doesn't have a dedicated security.txt feature. Two clean options:

Option A: Origin file

Create /.well-known/security.txt on your origin server (see the nginx or Apache guides for the file content and Content-Type configuration). Cloudflare proxies it through.

Option B: Cloudflare Worker (no origin needed)

export default {
  async fetch(request) {
    const url = new URL(request.url);
    if (url.pathname === "/.well-known/security.txt") {
      return new Response(
        "Contact: mailto:security@yourdomain.com\n" +
        "Expires: 2027-05-18T00:00:00.000Z\n" +
        "Preferred-Languages: en\n" +
        "Canonical: https://yourdomain.com/.well-known/security.txt\n",
        { headers: { "content-type": "text/plain; charset=utf-8" } }
      );
    }
    return fetch(request);
  }
};

5. Verify

curl -sI https://yourdomain.com/ | grep -iE "strict-transport|x-frame|x-content|referrer|permissions|content-security"
curl -sI https://yourdomain.com/.well-known/security.txt