Managed Transforms: One-Click HTTP Header Rules
HTTP header modification has been possible on Cloudflare for years, but it has never been trivial. Originally, the only option was writing a Cloudflare Worker. Then, in June 2021, Transform Rules gave customers a UI for setting static values like X-My-CDN: Cloudflare or dynamic ones such as X-Bot-Score: cf.bot_management.score.
Transform Rules solved the “how to modify” problem, but left the “what to modify” problem intact. Users still needed to know the exact field names from the rules language documentation to populate a header with a bot score or a visitor’s location. Examining production data revealed that pain: four of the eight most-used fields were bot management related, and three of the top ten were geolocation fields (city, country, ASN). More tellingly, Cloudflare saw over 400 Transform Rules that did nothing but remove X-Powered-By—hundreds of customers repeating the same lookup and configuration steps for the identical result.
What Managed Transforms Provides
Managed Transforms, found under Rules > Transform Rules via the “Managed Transforms” button, takes those repetitive patterns and packages them into single-click toggles. Customers no longer need to know field names or even that a field exists; they simply enable a named setting and Cloudflare writes the appropriate headers on every request.
For example, one toggle for bot protection headers adds four request headers carrying Cloudflare Bot Management signal data. This gives SIEM products structured data on request bot scores, including how many requests originate from verified bots, without customers needing any familiarity with the underlying rules language.
The principle extends beyond data enrichment to security scoring. A “security headers” toggle applies well-understood hardening headers to responses. With no other configuration, this moves a default zone from an F to a C; enabling HSTS raises it to a B (scores as of June 7, 2022). Customers can then opt into a Content-Security-Policy (for mitigating Cross-Site Scripting) or a Permission-Policy (for allowing or blocking browser features) individually; using one of these manually bumps the score to A, and using both reaches A+.
Why Security Headers Are Split
The team deliberately excluded default Content-Security-Policy and Permission-Policy from the single-click toggle. These headers tend to be site-specific: strict defaults broke page rendering on many sites, while permissive defaults carried no practical security value. They remain accessible as custom Transform Rules, letting admins define their own values and get the same effect in pursuit of that A+ score.
Managed Transforms does not replace Transform Rules—it complements them by shrinking the distance from a stated goal to a deployed configuration. Teams that want the commonplace behavior enforced with one click get it, while teams with unique header requirements still have the full power of the rule engine.
