Security on Cloudflare Pages: what to check
Cloudflare Pages hosts static front ends with optional Pages Functions for server-side code. HTTPS and certificates are handled for you.
Headers come from a _headers file in your build output, and secrets belong in Pages Functions as encrypted environment variables.
What to check on Cloudflare Pages
-
Are your security headers set?
Add a _headers file to your build output folder, under the path "/*".
-
Are secret API keys exposed in your front end?
Keep keys in a Pages Function, stored as an encrypted environment variable.
-
Is your domain protected with CAA and DNSSEC?
If your DNS is on Cloudflare, DNSSEC and a CAA record are a few clicks away.
-
Is your site publishing its source maps?
Check that your build does not publish source maps.
Where settings go on Cloudflare Pages
- Security headers
- On Cloudflare Pages, add it to a _headers file in your build output folder (for example public/_headers in a Vite app), under the path "/*".
- Secret keys
- Keep the key in a Cloudflare Pages Function and store it as an encrypted environment variable, without a VITE_ or NEXT_PUBLIC_ prefix.
Common questions
Where do security headers go on Cloudflare Pages?
In a _headers file in the folder your build outputs, for example public/_headers in a Vite app.
Do I need DNSSEC on Cloudflare?
It is optional, which is why the check only notes it. On Cloudflare it is easy to switch on.