_headers file in Cloudflare Pages: cache, security and noindex

You publish your new website on a Monday. On Tuesday you search for your business name on Google and, among the results, a strange address ending in pages.dev shows up with the same content as your domain. Nobody created it on purpose, but there it is, competing with you.

There is a simple way to prevent it, and to improve speed and security along the way: a text file of a few lines called _headers.

What is the _headers file in Cloudflare Pages?

It is a plain text file, with no extension, where you define HTTP headers that Cloudflare Pages adds to your site's responses. According to the Cloudflare documentation, it must live in your project's static files directory (in frameworks like Astro, the public/ folder) and Cloudflare processes it without publishing it as just another file.

Headers are invisible instructions that travel with every page: they tell the browser how much to keep in cache, tell Google whether to index something, or what permissions the page has. If you already migrated your site as we explained in the guide to migrating from WordPress to Cloudflare Pages, this is the next fine-tuning step.

How do you write a rule?

The first line is the path (or a pattern) and the indented lines below it are name: value pairs. An example based on the documentation:

/secure/page
  X-Frame-Options: DENY
  X-Content-Type-Options: nosniff

/static/*
  Access-Control-Allow-Origin: *

These are the pieces you need to know:

Element	What it does	Detail from the documentation
* (splat)	Matches all characters	Only one per URL; reused as :splat
:name (placeholder)	Captures part of the path	Each name can be referenced only once
! Name	Removes a header	Write the name with ! in front
Several rules match	The headers are added together	If one is repeated, the values are joined with a comma

Which headers are worth setting up?

Three uses cover almost every case for a business website: cache, security and indexing control.

For cache, the documentation shows a rule for files with a fingerprint in the name (those that change name when their content changes): Cache-Control: public, max-age=31556952, immutable on /static/*. That way the browser does not request those files again. This adds to what we explained in the guide to website speed and Core Web Vitals.

For security, Cloudflare gives example rules with X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy and Content-Security-Policy. Start with the simplest ones and test your site after each change: a content policy that is too strict can break scripts or fonts you do need.

Heads up: copying a security policy from another site without testing it is the fastest way to break your own page. Add one header at a time and check that everything loads.

How do I keep my pages.dev address from showing up on Google?

Add a rule that sets X-Robots-Tag: noindex on your project's pages.dev address. It is an example from Cloudflare's own documentation: the path is https://:project.pages.dev/*, with that header below it.

Google explains in its documentation on robots meta and X-Robots-Tag that any rule valid in a robots meta tag also works in this header, and that it is the recommended option for non-HTML files, such as PDFs or images.

Common mistake: blocking in robots.txt the URL you want to deindex. Google only sees the noindex if it can crawl the page; if robots.txt blocks it, the rule is ignored. If you use robots.txt for AI bots, also check our guide to robots.txt and AI bots.

What limits and priority rules does it have?

The maximum is 100 rules, with a cap of 2,000 characters per line. In addition, three behavior rules prevent surprises:

• Redirects from _redirects are applied before headers, so a redirect wins over a _headers rule. In the redirects documentation the default code is 302 and 301, 302, 303, 307 and 308 are accepted.
• The headers in _headers replace the default values Cloudflare sends.
• They are not applied to responses generated by Pages Functions. If your project uses them, define the headers inside the Function's code.

How do I check that it works?

Publish the change and check the actual headers of the response, not just the file. In the browser, open the developer tools, Network tab, select the page or file and look at the response headers. If one is missing, check the indentation, that the path matches and that no redirect or Function is interfering.

Then, ask Google to recrawl what you changed from Search Console, as explained in the Search Console and sitemap guide. And if you still do not know what the Cloudflare plan you use includes, here is the free plan guide.

In short

That pages.dev address that showed up next to your domain is solved with three lines in a text file. _headers is one of the cheapest improvements you can make to a static website: better cache, basic security and control over what Google indexes. If you want us to set it up and test it on your site, learn about our hosting and domains service.