Cloudflare Security Headers Setup

Complete step-by-step guide for mjsconnect.com

Estimated time: 5-10 minutes
1
Enable HSTS (HTTP Strict Transport Security)

Step 1.1: Access Cloudflare Dashboard

  1. 1.Go to https://dash.cloudflare.com
  2. 2.Log in with your Cloudflare credentials
  3. 3.Click on the mjsconnect.com domain from your list of sites

✅ You should now see the mjsconnect.com dashboard with tabs like "Analytics", "DNS", "SSL/TLS", etc.

Step 1.2: Navigate to SSL/TLS Settings

  1. 1.In the left sidebar, click on SSL/TLS
  2. 2.Then click on Edge Certificates (it's a sub-tab)

📍 Location: SSL/TLS → Edge Certificates

✅ You should see options like "Always Use HTTPS", "Automatic HTTPS Rewrites", etc.

Step 1.3: Enable and Configure HSTS

  1. 1.Scroll down until you see "HTTP Strict Transport Security (HSTS)"
  2. 2.Click the Enable HSTS button (or "Change" if it's already enabled)
  3. 3.A popup will appear. Configure these exact settings:

⚠️ Important: Read this warning before enabling

HSTS forces all connections to use HTTPS. Make sure your site works properly over HTTPS before enabling this.

Click "I understand" checkbox in the Cloudflare popup to proceed.

HSTS Settings to Configure:

Status: Enabled

Max Age Header (max-age):

31536000

(This is 12 months in seconds)

Apply HSTS policy to subdomains (includeSubDomains):

✅ ON (Enabled)

Preload:

✅ ON (Enabled)

(Allows browsers to preload HSTS)

No-Sniff Header:

✅ ON (Enabled)

(Sends X-Content-Type-Options: nosniff)

  1. 4.After configuring all settings, click "Next"
  2. 5.Review the summary and click "Submit"

✅ Part 1 Complete! HSTS is now enabled. Move to Part 2 to add the remaining security headers.

2
Add Security Headers via Transform Rules

Step 2.1: Navigate to Rules

  1. 1.In the left sidebar, click on Rules
  2. 2.You'll see several rule types. Click on Transform Rules
  3. 3.Click the Modify Response Header tab

📍 Location: Rules → Transform Rules → Modify Response Header

Step 2.2: Create New Rule

  1. 1.Click the blue "+ Create rule" button (top right)
  2. 2.In the "Rule name" field, enter:
    Security Headers for MJS Connect

Step 2.3: Configure Rule Match

  1. 1.Under "When incoming requests match...", you'll see a field selector
  2. 2.Click the "Field" dropdown and select "All incoming requests"

💡 This means the security headers will be added to ALL pages on mjsconnect.com

Step 2.4: Add Each Security Header

Now we'll add 7 security headers. For each header, you'll click "+ Set static" and fill in the name and value.

Header 1 of 7

X-Content-Type-Options

  1. 1.Click "+ Set static" button
  2. 2.
    In the "Header name" field, enter:
    X-Content-Type-Options
  3. 3.
    In the "Value" field, enter:
    nosniff

✅ After adding this header, click "+ Set static" again to add the next one

Header 2 of 7

X-Frame-Options

  1. 1.Click "+ Set static" button
  2. 2.
    In the "Header name" field, enter:
    X-Frame-Options
  3. 3.
    In the "Value" field, enter:
    SAMEORIGIN

✅ After adding this header, click "+ Set static" again to add the next one

Header 3 of 7

Referrer-Policy

  1. 1.Click "+ Set static" button
  2. 2.
    In the "Header name" field, enter:
    Referrer-Policy
  3. 3.
    In the "Value" field, enter:
    strict-origin-when-cross-origin

✅ After adding this header, click "+ Set static" again to add the next one

Header 4 of 7

Permissions-Policy

  1. 1.Click "+ Set static" button
  2. 2.
    In the "Header name" field, enter:
    Permissions-Policy
  3. 3.
    In the "Value" field, enter:
    geolocation=(), microphone=(), camera=()

✅ After adding this header, click "+ Set static" again to add the next one

Header 5 of 7

Cross-Origin-Opener-Policy

  1. 1.Click "+ Set static" button
  2. 2.
    In the "Header name" field, enter:
    Cross-Origin-Opener-Policy
  3. 3.
    In the "Value" field, enter:
    same-origin

✅ After adding this header, click "+ Set static" again to add the next one

Header 6 of 7

Cross-Origin-Resource-Policy

  1. 1.Click "+ Set static" button
  2. 2.
    In the "Header name" field, enter:
    Cross-Origin-Resource-Policy
  3. 3.
    In the "Value" field, enter:
    same-site

✅ After adding this header, click "+ Set static" again to add the next one

Header 7 of 7

Content-Security-Policy

  1. 1.Click "+ Set static" button
  2. 2.
    In the "Header name" field, enter:
    Content-Security-Policy
  3. 3.
    In the "Value" field, enter:
    default-src 'self'; script-src 'self' 'unsafe-inline' https://secure.na3.adobesign.com https://api.na3.adobesign.com https://docspring.com https://*.docspring.com; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://*; frame-src https://secure.na3.adobesign.com https://*.docspring.com; connect-src 'self' https://api.na3.adobesign.com https://*.docspring.com; font-src 'self' data:; base-uri 'self'; form-action 'self' https://secure.na3.adobesign.com https://*.docspring.com; frame-ancestors 'self'; upgrade-insecure-requests

Step 2.5: Deploy the Rule

  1. 1.After adding all 7 headers, scroll to the bottom
  2. 2.Click the blue "Deploy" button

✅ Part 2 Complete! All security headers are now configured.

3
Verify Your Configuration

Wait for Propagation

Wait 2-3 minutes for Cloudflare's changes to propagate globally.

Test Your Security Headers

Use these tools to verify everything is working:

SecurityHeaders.com

Comprehensive header analysis

Mozilla Observatory

Security best practices check

SSL Labs

SSL/TLS configuration test

Expected Results

✅ You should see:

  • Grade A or A+ on SecurityHeaders.com
  • 100% security score
  • All 8 security headers present and properly configured
  • HSTS enabled with preload
Troubleshooting

❌ Headers not showing up?

  • Wait the full 2-3 minutes for propagation
  • Clear your browser cache (Ctrl+Shift+Delete)
  • Try testing from a different browser or incognito window
  • Verify the Transform Rule is "Deployed" (not "Draft") in Cloudflare

❌ Site not loading after enabling HSTS?

  • Make sure your site has a valid SSL certificate
  • Check that "SSL/TLS encryption mode" is set to "Full" or "Full (strict)"
  • If needed, you can disable HSTS temporarily from the same menu

❌ CSP blocking resources?

  • Check browser console for CSP errors (F12 → Console)
  • You may need to add additional domains to the CSP value
  • Contact support if you need help adjusting the CSP policy

Need help? Contact your IT administrator or email humanresources@mjsia.com with screenshots of any errors.