Header modification without code arrives in Cloudflare Transform Rules

HTTP headers carry the metadata that makes web communication possible, from security rules to client information that helps servers deliver appropriate content. Cloudflare has now made HTTP request header modification generally available as a Transform Rules action across all plans, giving administrators a code-free way to set or remove headers as traffic passes through Cloudflare's network.

Until now, header manipulation typically required writing logic in a reverse proxy configuration or implementing a Cloudflare Worker. Transform Rules eliminate that overhead: header enrichment such as appending the Cloudflare Bot Management "Bot Score" to requests bound for origin servers is now achievable through the dashboard without scripting.

Headers as internet luggage tags

Like the tags affixed to checked luggage, HTTP headers carry vital routing information. They encode details that determine not only whether a request or response reaches the right endpoint, but also whether that exchange happens efficiently and securely. While users never need to inspect these values directly, their presence is fundamental to a functioning web.

What request headers control

Request headers are set on the outbound leg of an interaction, when a client asks for a resource. Organizations use these headers to route traffic to specific clusters, tailor responses for mobile devices or legacy browsers, and enforce authentication through mechanisms like pre-shared custom headers.

The effort of populating request headers typically belongs to the reverse proxy positioned between client and origin. NGINX deployments achieve this with configuration directives, and Cloudflare Workers can do the same in code. Both approaches add a custom header such as X-Header-Name with a value of custom to the upstream request, but each requires managing separate infrastructure or scripted logic.

Three header actions, one rule

HTTP Request Header Modification in Transform Rules supports up to 10 header modifications per rule through three operations:

  • Set dynamic – populates a header per request using available values. Useful for injecting data like the Cloudflare bot score or the visitor's country code.
  • Set static – assigns a fixed literal string, such as identifying Cloudflare as the CDN or adding a shared secret.
  • Remove – strips all headers with the specified name, for example deleting cf-connecting-ip from traffic forwarded upstream.

Both set operations overwrite any existing value on a matching header rather than appending to it.

Dynamic values with Cloudflare functions

For dynamic headers, Cloudflare's expression language is available and includes concat(), regex_replace(), to_string(), and lower(). A common combination is concat("score=",to_string(cf.bot_management.score)), which produces a header value like score=85. Customers on Business and Enterprise plans also have access to regex functions.

The new action targets operational improvements, removing sensitive data before it reaches origin infrastructure, and adding an extra authentication layer — all without managing separate code deployments.