CF _headers & _redirects
Cloudflare Pages & Edge Networking

Cloudflare Pages & Workers _headers & _redirects Generator

Generate Cloudflare Pages _headers and _redirects configuration files with HSTS, CSP, X-Frame-Options, caching rules, and 301/302 URL redirects.

100% Client-Side Privacy
Zero Server Transmission
Presets:

Header Path Scopes

3 Scopes
Path Pattern:
Quick Inject:
:
:
:
:
:
:
:

URL Redirect Rules

3 Rules
→
Condition:
→
Condition:
→
Condition:
Scopes: 3Directives: 12Redirects: 3
100% Client-Side Privacy
# Cloudflare Pages _headers configuration
# Generated with ToolsAA (https://toolsaa.com)
# Docs: https://developers.cloudflare.com/pages/configuration/headers/

# Global root security headers
/*
  Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
  X-Frame-Options: DENY
  X-Content-Type-Options: nosniff
  Referrer-Policy: strict-origin-when-cross-origin
  Permissions-Policy: camera=(), microphone=(), geolocation=(), payment=()
  Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' https://challenges.cloudflare.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; font-src 'self' data:; connect-src 'self' https:; frame-ancestors 'none'; base-uri 'self'; form-action 'self';
  Cross-Origin-Opener-Policy: same-origin

# Long-term immutable static caching
/assets/*
  Cache-Control: public, max-age=31536000, immutable

# REST API CORS policies
/api/*
  Access-Control-Allow-Origin: *
  Access-Control-Allow-Methods: GET, POST, PUT, DELETE, OPTIONS
  Access-Control-Allow-Headers: Content-Type, Authorization, X-Requested-With
  Cache-Control: no-store, no-cache, must-revalidate
Lines: 25Size: 1147 BFormat: _headers
Cloudflare RFC Compliant
Path Scopes
3 Active Paths

Matches wildcard patterns across root and static folders.

Total Directives
12 Headers + 3 Redirects

Synthesized into flat plain-text edge configuration files.

Security Grade
A+ (100/100)

Evaluates HSTS, CSP, X-Frame-Options, and circular redirects.

100% Client-Side Private Processing

All header compilation, CSP synthesis, and redirect syntax parsing run entirely within your local browser sandbox. Zero telemetry or server transmission.

Cloudflare Edge Spec RFC Compliance

Strict adherence to Cloudflare Pages _headers and _redirects specifications, supporting splats (:splat), forced rewrites (!), and status code validation.

Multi-Format Cloud Deployment

Instantly export dual Pages flat files, type-safe Cloudflare Workers fetch handlers, or Next.js next.config.js routing definitions with 1-click.

Technical Reference & Architecture Guide

Cloudflare Headers & Redirects Generator — Reference Guide

Authoritative developer reference and syntax cheatsheet for configuring Cloudflare Pages _headers and _redirects rules, security policies, and edge rewrites.

Key Parameters & Controls

sourcestring

Incoming request path pattern matching routes in _redirects, supporting wildcards (*), splats (:splat), and named placeholders (:slug).

Default: /*
targetstring

Destination URL or root-relative path for the rewrite or redirection, receiving values from matched splats or URL tokens.

Default: /:splat
status301 | 302 | 307 | 308 | 200

HTTP response status code emitted by Cloudflare edge; 200 triggers an internal rewrite, while 301 and 308 perform permanent redirects.

Default: 301
forceboolean

When enabled, forces the redirect rule to execute even if an identical static asset exists at the source path, formatting the code as 200! or 301!.

Default: false
pathstring

URL path prefix or glob pattern in _headers designating which client requests receive the associated HTTP response header directives.

Default: /*

Pro Tips & Best Practices

Enforce Force Flag on SPA Rewrites

When configuring single-page application fallback rules (/* /index.html 200), append ! to declare 200! if you need HTML rewriting to take precedence over matching public directory index files.

Respect Rule Limits in Pages

Cloudflare Pages enforces a hard limit of 100 rules in _headers and 2,000 rules in _redirects. Consolidate static asset headers under wildcard blocks like /assets/* to avoid silent truncation.

Leverage Splat Tokens for Paths

Using /* /archive/:splat 301 forwards matching wildcards directly to the target. Avoid mixing standard splat matching with multiple distinct query parameter conditions in the same line.

Common Gotchas & Troubleshooting

Static file shadowing prevents 200 rewrite execution

Cloudflare Pages serves existing static assets before evaluating redirect rules by default. Set force: true or append an exclamation mark to the status code (e.g., 200!) in _redirects to override static file serving.

Headers truncated beyond Cloudflare 100-rule limit

Cloudflare Pages silently drops header declarations exceeding 100 rules in _headers. Group identical security headers (HSTS, CSP, X-Frame-Options) under root wildcard /* and combine asset headers under /assets/*.

Frequently Asked Questions

Where must the _headers and _redirects files be located in a project build?▼

Both _headers and _redirects must be placed in the build output directory (publish directory) that is deployed to Cloudflare Pages (such as dist/, out/, or build/). If placed only in the project root, Cloudflare will not include them in the static deployment artifact.

What is the operational difference between a 301 redirect and a 200 rewrite?▼

A 301 redirect issues an HTTP 301 Moved Permanently status code instructing the client browser to request the target URL, changing the address bar. A 200 status code performs an internal server-side rewrite where Cloudflare serves content from the target URL while preserving the original request URL in the user address bar, essential for Single-Page Application (SPA) client-side routing.

How does Cloudflare handle conflicting header rules for the same path?▼

Cloudflare Pages evaluates _headers rules in top-to-bottom order. More specific path patterns do not automatically override earlier generic patterns; instead, Cloudflare merges headers. If the exact same header name is defined multiple times across matching paths, the last defined value in the _headers file takes precedence.

Does Cloudflare Pages support regex pattern matching in _redirects?▼

No, Cloudflare Pages _redirects files do not support full regular expressions. Routing matches rely on path prefixes, single wildcards (*), and splat replacements (:splat), alongside query parameters or named placeholders (:id). For complex regex routing or dynamic edge transformations, migrate the logic to Cloudflare Workers or Pages Functions.

Related Tools & Utilities

All Tools →
Vercel Configuration (vercel.json) Interactive BuilderDeveloper

Build vercel.json configuration files with custom routing rewrites, redirects, headers, cleanUrls, trailingSlash, and cron job declarations.

Open tool→
ESLint Flat Config (eslint.config.mjs) Interactive BuilderDeveloper

Generate modern ESLint 9+ flat configuration files (eslint.config.mjs / .js) with TypeScript, React, Next.js, Vue, Prettier, and custom plugin rules.

Open tool→
SemVer Range & Version Satisfaction CalculatorDeveloper

Test semantic versioning (SemVer) ranges (caret ^, tilde ~, hyphens, x-ranges, pre-releases) and evaluate package version satisfaction in real-time.

Open tool→
Cron Expression Parser & Schedule ExplainerDeveloper

Translate cryptic 5-part and 6-part cron expressions into plain English explanations and predict the next 10 upcoming run dates.

Open tool→
Interactive JavaScript Regular Expression (RegEx) Tester & MatcherDeveloper

Test, debug, and benchmark regular expressions in real-time with capture group extraction, replacement previews, regex flag toggles, and syntax explanations.

Open tool→
URL / URI Component Encoder & DecoderDeveloper

Encode and decode query strings, URLs, and UTF-8 characters instantly.

Open tool→