Set Cloudflare HTTP Headers in Hugo

In a previous post I wrote about how to set Cloudflare HTTP headers using Cloudflare Workers. In this post, I’ll show you how to do the same thing using Hugo.

Thanks to Grok, I learned a nifty trick for setting Cloudflare HTTP headers in Hugo. Instead of using Cloudflare Workers, you can use Hugo’s built-in support for setting HTTP headers.

To do so, create the file static/_headers with your header content following Cloudflare’s format. As an example, here’s the content of this site’s static/_headers file:

/*
  X-Content-Type-Options: nosniff
  X-Frame-Options: deny
  Referrer-Policy: no-referrer
  Feature-Policy: microphone 'none'; payment 'none'; geolocation 'none'; midi 'none'; sync-xhr 'none'; camera 'none'; magnetometer 'none'; gyroscope 'none'
  Content-Security-Policy: default-src 'none'; manifest-src 'self'; font-src 'self'; img-src 'self'; style-src 'self'; form-action 'none'; frame-ancestors 'none'; base-uri 'none'
  X-XSS-Protection: 1; mode=block
  Strict-Transport-Security: max-age=300

When Cloudflare builds the site, it will automatically include these headers in the response. No additional configuration is required.

Verify your headers with curl:

curl -I https://www.chrislockard.net/