Security Headers Injector Worker

Harden Every Response with the Right Security Headers — Instantly

A Cloudflare Worker that automatically appends HSTS, CSP, X-Frame-Options, X-Content-Type-Options, and Referrer-Policy to every response from your origin. No code deploys, no server config changes required.

What's Included

• Cloudflare Worker that proxies your origin and injects security headers
• Pre-configured, sane-default values for all major security headers
• Configurable Content Security Policy via environment variable
• wrangler.toml ready for deployment
• README with header explanations and customization guide

Headers Injected

• Strict-Transport-Security (HSTS) — enforces HTTPS for 1 year, includes subdomains
• Content-Security-Policy (CSP) — configurable policy to prevent XSS
• X-Frame-Options — blocks clickjacking by preventing iframe embedding
• X-Content-Type-Options — prevents MIME-type sniffing attacks
• Referrer-Policy — controls referrer information sent to third parties

What You Get

• Instant security hardening without touching your application
• Works with any origin: static sites, APIs, SPAs, legacy apps
• Pass security header scanners and penetration tests immediately
• Centralised header management — one config file governs all your routes

Requirements

• Cloudflare account (free tier works)
• Domain on Cloudflare DNS
• Wrangler CLI installed (npm install -g wrangler)