In short. Cloudflare Set replaces existing headers with a name, while Add preserves them and appends another header with that name.
Definition: Cloudflare Response Header Transform Rules change HTTP response headers sent to website visitors. Set replaces all existing headers with the selected name, while Add appends another header with that name and keeps the existing headers.
Key facts
- Cloudflare's response header transform reference says Set can overwrite an existing value or create a header when the name is absent.
- Add keeps existing headers with the same name and adds a new header with either a literal value or an expression result.
- Set and Add are available for literal strings and expressions, so the difference concerns how the named header is handled after the value is calculated.
- RFC 9110 describes a repeated field name as a list of field line values in received order, with each value separated by a comma when the field's semantics allow that combination.
What does Set change?
Set establishes the value for a response header name. Cloudflare documents both a literal form and an expression form. If the response already contains that header name, Set overwrites its previous value. If the name is absent, Set adds a new header.
The operation applies to all existing headers with that name. That detail matters when the response contains more than one field line. A Set operation therefore selects one replacement value for the name rather than retaining the earlier field lines. Cloudflare also states that later response header transform rules can overwrite changes made by earlier rules.
What does Add preserve?
Add creates a new response header with the chosen name and value without removing existing headers of that name. The operation also has literal and expression forms. RFC 9110 calls each occurrence a field line and says that repeated field names form a combined field value according to the field's rules, with the values kept in order.
Set-Cookie is the clearest case. RFC 9110 describes it as a field that often appears on multiple lines and cannot be combined into one field value. Cloudflare therefore recommends Add static or Add dynamic for a new set-cookie header. Using Set static or Set dynamic removes the existing set-cookie headers, including ones added by other Cloudflare products such as Bot Management.
Set-Cookie: session=abc
Set-Cookie: preferences=compact
Which operation should a site use?
Use Set when the response should expose one replacement value for a header name, including when a previous value must be removed. Use Add when the response should retain existing values and carry a separate field line. The correct choice also depends on the header's own HTTP field definition, because RFC 9110 permits combination for fields whose semantics support a comma-separated list and treats Set-Cookie separately.
Cloudflare's reference says response header values are calculated from the corresponding HTTP request field values. It also provides Cloudflare Trace as the tool for determining whether a rule triggers for a specific URL. A trace and the returned response headers show whether the configured operation produced a replacement or an additional field line.
Related terms
FAQ
Does Set create a header when the response has none?
Yes. Cloudflare documents that Set adds the header when the named header does not exist. When the name already exists, Set overwrites the previous value.
Should Set or Add be used for another Set-Cookie value?
Use Add static or Add dynamic. Cloudflare says Add preserves existing set-cookie headers, whereas Set removes them, including headers added by other Cloudflare products.
Does Add always produce a comma-separated value?
The operation adds a separate header. RFC 9110 says repeated field lines are combined with commas when the field definition permits that form, while Set-Cookie remains a special case that cannot be combined into one field value.
Sources
- Cloudflare, "Response Header Transform Rules", 4 September 2026
- IETF, "RFC 9110: HTTP Semantics", June 2022
Check how a page reads to answer engines. Open the GEO score analyzer