Alexis Kestler
Implementing proper HTTP security headers is one of the most important best practices for securing modern websites. These headers help mitigate many of the OWASP Top 10 web vulnerabilities like cross-site scripting (XSS), clickjacking, content sniffing, and more.
According to Cloudflare‘s own security research, 26% of the top 1 million websites have poor header configurations that leave them vulnerable. And Cloudflare sees over 30 billion cyber threats per day on average. Suffice to say, getting your headers configured correctly is mission critical.
In the past, adding security headers meant diving into config files for your web server like Nginx, Apache, or IIS. But if your sites are fronted by Cloudflare, you now have an easier and more flexible option – Cloudflare Workers.
As a long-time cybersecurity analyst and self-proclaimed tech geek, I think Workers provide one of the most frictionless ways to implement security headers across your web presence. Let‘s dive in…
What Are Cloudflare Workers and Why Do They Matter?
For those who aren‘t familiar, Cloudflare Workers are a "serverless" platform that allows running JavaScript at Cloudflare‘s global edge network. Your code gets executed when HTTP requests pass through Cloudflare on their way to your origin servers.
This unlocks lots of potential like modifying response headers and content, routing requests, building APIs, and more. And it takes place at 200+ data centers around the world without touching your infrastructure.
According to Cloudflare, Workers have some incredibly powerful properties:
- Instantaneous code deployment – Your code is deployed globally in seconds
- Flexible scripting – Write handlers in JavaScript or compile from languages like C and Rust
- Edge-scale computing – Leverage Cloudflare‘s network spanning 200+ cities in 100+ countries
- Developer productivity – Integrates with modern tools like npm, wrangler, and more
So in summary, Workers allow us to execute logic at a global scale reliably and instantly. That makes them a perfect solution for injecting security headers at the edge.
Step-by-Step: Adding Headers with a Worker
Let‘s go through a simple example using a pre-made template from Scott Helme, an internationally recognized security expert.
1. Create a Worker
Log into the Cloudflare dashboard, navigate to Workers, and click "Create a Worker". You‘ll be taken to the script editor.
Paste in the worker code from Scott‘s GitHub:
const securityHeaders = {
"Content-Security-Policy": "upgrade-insecure-requests",
// ... more headers ...
}
addEventListener("fetch", event => {
// ... logic to add headers ...
})This initializes a set of headers like CSP, XSS protection, HSTS, etc. with secure defaults.
2. Customize the Headers
Before deploying, tailor the headers based on your application requirements:
CSP – Allow iframe embeds from specific sources with frame-ancestors.
X-Frame-Options – Enable iframes from same origin with SAMEORIGIN.
Server – Mask technology details by sanitizing this header.
Remove Headers – Strip headers that reveal software versions.
Add Custom Headers – Include any app-specific headers needed.
See the GitHub README for more examples.
3. Deploy the Worker
Once customized, deploy the worker and give it a name like security-headers.
4. Add a Route to Your Website
Back on the Cloudflare dashboard, navigate to the site you want to use the worker for.
Under "Workers", click "Add route" and specify the root domain or path prefix to enable the headers on.
Select the deployed worker, save it, and… done! The headers will now be applied.
Testing and Deploying Your Worker
Once connected, use developer tools or an HTTP header checker to validate the headers are present as expected.
I recommend testing on a staging environment before deploying to production traffic. Start with specific routes first, then expand more broadly once you‘ve verified correct behavior.
Since Workers deploy globally in seconds, you can iteratively improve and add to your header logic over time with instant results.
Some additional tips when rolling out:
- Monitor for any breaking changes and revert if needed
- Consider allowing some endpoints to skip headers to support legacy flows
- Rotate credentials if headers reveal sensitive keys/tokens
Why Cloudflare Workers Excel at Implementing Security Headers
There are many advantages to using Workers for injecting security headers, including:
Instant deployment – Changes deploy globally in seconds, no waiting for web server restarts.
Fine-grained control – Easily apply headers across your entire domain or specific paths with regex matching.
Painless rollback – If anything breaks, disabling the worker route is instant.
Edge-side power – Runs on a robust serverless platform spanning 6+ million sites.
Simplified management – No need to modify your origin web server configs.
Scripting flexibility – Implement logic in JavaScript or compile from C, Rust, and more.
Rapid iteration – Enhance header configs gradually and refresh instantly.
Insights – Logging and metrics available to debug and monitor.
Polyglot benefits – Utilize existing npm packages and tools.
For any security-conscious website owner, Cloudflare Workers are a game changer. The ease of use and flexibility enabled at the network edge is outstanding.
I highly recommend exploring Workers both for implementing security headers and beyond. Please drop me a comment below if you have any other tips or questions!
