Security headers › Content-Security-Policy
How to add the Content-Security-Policy header in Cloudflare
CSP tells the browser which sources of scripts, styles, images and frames are allowed on your pages.
Cloudflare configuration (Transform Rules)
Rules > Transform Rules > Modify Response Header
Action: Set static
Header name: Content-Security-Policy
Value: default-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'Create the rule for your hostname in the Cloudflare dashboard. For HSTS, Cloudflare also has a dedicated setting under SSL/TLS > Edge Certificates. On Cloudflare Pages you can use a _headers file instead.
Before you deploy
A strict CSP can break analytics, fonts and inline scripts. Start with Content-Security-Policy-Report-Only, watch the reports, then enforce. The value here is a starting point you will need to extend.
Verify it works
curl -sI https://your-site.com | grep -i content-security-policyOr run a free Korrali Web scan to check this and every other security header at once.