Adding Security Headers Globally with Cloudflare Workers

Problem: injecting headers without touching the origin

Many teams need to enforce security policies such as Strict-Transport-Security (HSTS) or custom logging across all hostnames served by a domain. Doing this in the application layer requires code changes, redeploys, and coordination with every service that sits behind the domain. If the origin is slow to update or runs on a heterogeneous stack, the header can be missing for a noticeable period, leaving users exposed.

Thesis: Cloudflare Workers let you inject or modify headers at the edge, centrally and with low latency

A Worker is a lightweight JavaScript service that runs in Cloudflare’s V8 isolates on every data center. It intercepts the fetch event, can read or modify request/response objects, and then forwards the traffic to the origin. Because the code executes close to the client, the added latency is typically under a millisecond, and the rollout is instantaneous once the Worker is published.

Writing a simple header‑injector Worker

The following script adds an HSTS header with a one‑year max‑age and includes the includeSubDomains directive. It also logs the request path to the console (visible via wrangler tail or the dashboard logs).

addEventListener('fetch', event => {
  event.respondWith(handleRequest(event.request))
})

async function handleRequest(request) {
  // Log the path for debugging
  console.log(`Request path: ${new URL(request.pathname).pathname}`)

  // Fetch the original response from the origin
  const response = await fetch(request)

  // Clone the response so we can modify headers
  const modified = new Response(response.body, response)
  modified.headers.set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains')

  return modified
}

Save this as src/index.js in a new Wrangler project.

Deploying and testing the Worker

1. Initialize the project (run in a terminal with a Cloudflare API token that has Workers Scripts edit permission):

   wrangler init hsts-worker --type=javascript
   cd hsts-worker
   

2. Add the script – replace the generated src/index.js with the code above.
3. Preview locally – start the dev server and make a request to http://localhost:8787:

   wrangler dev
   

   In another terminal, run:

   curl -I http://localhost:8787
   

   You should see the strict-transport-security header in the response.
4. Publish to the edge – when the preview works, publish the Worker to your zone:

   wrangler publish
   

   This creates a route pattern (e.g., example.com/*) that you configure in the Cloudflare dashboard under **Workers → Triggers**.
5. Verify in production – after the route is active, check a real hostname:

   curl -I https://example.com
   

   Look for the header strict-transport-security: max-age=31536000; includeSubDomains.

Trade‑offs and limitations

• Free‑tier limits – Workers on the free plan are capped at 100 000 requests per day and 50 ms of CPU time per request. The header‑injector script uses well under 1 ms, but if you add expensive logic (e.g., large JSON parsing, external API calls) you may hit the CPU limit and see requests throttled or served with a 1102 error.
• Debugging workflow – console.log output does not appear in browser developer tools. You must rely on the Cloudflare dashboard logs or run wrangler tail to see debug messages while developing.
• Atomicity – Because the Worker runs before the origin, any error in the script (e.g., an exception) will generate a 1101 Worker error response, bypassing the origin entirely. Test thoroughly in wrangler dev before publishing.

Actionable closing

Start with a minimal header‑injector like the one above, monitor the Requests and Average CPU Time metrics in the Workers dashboard, and iterate using wrangler dev for fast feedback. If your traffic approaches the free‑tier thresholds, consider upgrading to a paid Workers plan or offloading heavier computation to Workers KV or the origin. This approach gives you a centralized, low‑latency way to enforce security headers without touching any application code.