Cloudflare doesn't respect servers X-Frame-Options header

Website, Application, Performance Security
1

Does the cloudfare dashboard let you set X-Frame-Options? Without a worker?

Because Cloudflare doesn’t take into account the headers I have set on my server, because Cloudflare is serving my site. So when I run curl domain.com -v, cloudflares responses comes through, not my server.

1 Like
2

Im facing the same issue, even though i’ve configured my app to use SAMEORIGIN, it uses DENY instead

3

Anyone got any ideas?

4

Under Rules > Transform Rules > Modify Response Header, try creating a rule:

  • with Custom filter expression (http.host eq "your-website.com")
  • Set static X-Frame-Options =

cc @azim1

4 Likes