Cloudflare CSP Setup Guide

Prefer to configure Cloudflare manually? Follow the steps below.

• A Cloudflare account with your domain added
• Access to Cloudflare Workers or Transform Rules
• A CSP Warden account with a verified domain
• Your domain reporting token (found in your CSP Warden dashboard)

The simplest approach uses Cloudflare's HTTP Response Header Modification rules. Navigate to Rules > Transform Rules > Modify Response Header in your Cloudflare dashboard and create a new rule:

• Rule name: CSP Report-Only
• When: All incoming requests (or filter by hostname/path)
• Then → Set static header:

Header name:  Content-Security-Policy-Report-Only
Header value: default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint

# Add a second "Set static header" action for the companion header:
Header name:  Reporting-Endpoints
Header value: csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/"

Set both headers: report-to names a reporting group (csp-endpoint), and the Reporting-Endpoints header maps that name to the actual HTTPS URL. Type the value into the dashboard field exactly as shown - Cloudflare takes the quotes literally. The legacy report-uri keeps older browsers working.

For more flexibility, use a Cloudflare Worker to add the CSP header. Create a new Worker:

export default {
  async fetch(request, env) {
    const response = await fetch(request);
    const newResponse = new Response(response.body, response);

    newResponse.headers.set(
      "Content-Security-Policy-Report-Only",
      "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; report-uri https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/; report-to csp-endpoint"
    );
    // Companion header: maps the "csp-endpoint" group named by report-to to your report URL
    newResponse.headers.set(
      "Reporting-Endpoints",
      'csp-endpoint="https://cspwarden.com/api/v1/csp-report/YOUR-DOMAIN-TOKEN/"'
    );

    return newResponse;
  },
};

Then attach the Worker to your domain via a route in Workers Routes or as a Worker Route in your zone settings:

Route pattern: yourdomain.com/*
Worker:        csp-header-worker

After reviewing violations in your CSP Warden dashboard, replace Content-Security-Policy-Report-Only with Content-Security-Policy in either your Transform Rule or Worker code.

• Header not appearing: Ensure the Transform Rule is active and matches the correct hostnames. Check the rule order - later rules can override earlier ones.
• Worker not triggering: Verify the Worker route pattern matches your domain and the Worker is deployed and active.
• Duplicate headers: If your origin server also sets CSP headers, use the Remove action in Transform Rules to strip the origin header before setting your own, or use response.headers.delete() in the Worker.
• Caching issues: Cloudflare may cache responses without the new header. Purge your cache after adding the rule to ensure the header appears immediately.