# cloudflare/headers

> Checks that `_headers` holds only blocks of a path followed by indented name-value lines, and that the block for every path sets the content type, referrer, and framing headers.

Checks that `_headers` holds only blocks of a path followed by indented name-value lines, and that the block for every path sets the content type, referrer, and framing headers.

Part of the [`cloudflare`](/reference/configurations/cloudflare/) configuration, at the `recommended` [level](/start/concepts/#levels). It runs at the `commit` [stage](/start/concepts/#stage), once per scope. gspot runs this check itself.

## Why

Cloudflare skips a line it cannot read, and a static site has no server code to set these protections, so a typo or a missing line silently drops a security header.

## What to do

Write each block as a path, then indented lines of a name, a colon, and a value. Add each missing security header to the block for `/*`.

## Example

An indented `X-Frame-Options: DENY` at the top of `_headers` reports a header with no path. Put a path such as `/*` on an unindented line above it.

## Turn it off

Turn it off for some files, with a reason:

```shell
gspot ignore cloudflare/headers --paths "<glob>" --reason "<why>"
```