Do Cloudflare Pages _headers rules apply to Functions responses?

Definition: No. As of 17 October 2026, Cloudflare Pages applies _headers rules to static asset responses and excludes responses generated by Pages Functions, even when the request URL matches a rule. Custom headers for Function-generated responses belong in the Function's response code.

Key facts

• Cloudflare's custom headers documentation explicitly covers server-side rendering, the functions/ directory, and advanced-mode _worker.js in its warning about excluded responses.
• The Functions routing documentation describes a fallback to an available static asset when no Function matches a request.
• Cloudflare's middleware documentation places application-wide middleware in functions/_middleware.js, including middleware that runs before static files.
• The Adding CORS headers example sets response headers in code and includes a separate handler for the OPTIONS request method.

Which responses are excluded from static header rules?

Cloudflare's Headers documentation distinguishes static asset responses from responses generated by Pages Functions. Server-side rendering (SSR) means generating a page on the server; Cloudflare includes SSR frameworks in this warning. The exclusion also covers Functions implemented through a functions/ directory or an advanced-mode _worker.js file.

A matching path in _headers therefore provides no header configuration for a Function-generated response. The same documentation directs applications to attach custom headers within Pages Functions code. Its security-header guidance specifically includes application programming interface (API) endpoints and requires cross-origin response headers on OPTIONS requests when those headers are needed.

For static assets, _headers remains a plain text file without an extension in the project's static asset directory. Pages parses that file into rules; the file itself is excluded from serving as a static asset.

How can Function code attach a header?

Cloudflare's Adding CORS headers example demonstrates cross-origin resource sharing (CORS), the mechanism used here to allow requests from other origins. Its handler awaits context.next(), sets headers on the returned response, and returns that response. The following JavaScript adapts that pattern to retain only the origin header:

export const onRequest = async (context) => {
  const response = await context.next();
  response.headers.set("Access-Control-Allow-Origin", "*");
  return response;
};

Cloudflare's middleware documentation identifies middleware as reusable logic that runs before an onRequest function. A functions/_middleware.js file applies across the application, including before static files. Middleware in a subdirectory applies to matching Functions in that directory and its subdirectories.

The CORS example also exports onRequestOptions to construct the preflight response. That handler matters when an endpoint must respond to the browser's cross-origin permission check.

How can a missing header be investigated?

The routing documentation maps Function files to request paths. It also documents _routes.json, placed in the build directory, to control Function invocation. Its exclude rules take priority over include rules.

Investigation starts with the requested path, its matching Function, and any middleware. For a response generated by that code, the header-setting logic belongs in the code path that returns it. For a static asset response, the relevant configuration is the matching _headers rule. Checking only the URL pattern leaves the response's source unresolved.

Related terms

• How do I set X-Robots-Tag on Cloudflare Pages?
• How do I set different headers for Cloudflare Pages paths?
• Server-side rendering
• X-Robots-Tag

FAQ

Does a wildcard in _headers cover Function-generated pages?

No. Cloudflare's Headers documentation explicitly excludes Function-generated responses even when their request URL matches an _headers rule.

Where can I set a header across several Functions?

You can use a functions/_middleware.js file. Cloudflare's middleware documentation also supports placing middleware in a subdirectory to limit its scope to that directory and its subdirectories.

Sources

1. Cloudflare, "Headers", updated 25 August 2026
2. Cloudflare, "Routing", updated 18 September 2026
3. Cloudflare, "Middleware", updated 21 April 2026
4. Cloudflare, "Adding CORS headers", updated 21 April 2026

---

Check how a page reads to answer engines. Open the GEO score analyzer