INTEGRITY Cloudflare Docs

← Rules / rules / transform / managed-transforms

Available Managed Transforms

This page lists the available Managed Transforms. They can modify HTTP request headers or response headers.

For more complex and customized header modifications, consider using Snippets.

Important remarks

HTTP request headers

Add bot protection headers

Adds HTTP headers with bot-related values to the request sent to the origin server:

Add TLS client auth headers

Adds HTTP headers with Mutual TLS (mTLS) client authentication values to the request sent to the origin server:

Add visitor location headers

Adds HTTP headers with location information for the visitor's IP address to the request sent to the origin server:

Encoding of non-ASCII header values

Cloudflare always converts non-ASCII characters to UTF-8 in HTTP request and response header values. This applies to location headers added by the Add visitor location headers managed transform.

Add "True-Client-IP" header

Adds a true-client-ip request header with the visitor's IP address.

This Managed Transform is unavailable when Remove visitor IP headers is enabled.

Remove visitor IP headers

Removes HTTP headers that may contain the visitor's IP address from the request sent to the origin server. Handles the following HTTP request headers:

This Managed Transform is unavailable when Add "True-Client-IP" header is enabled.

Visitor IP address in the x-forwarded-for HTTP header

For the x-forwarded-for HTTP request header, enabling Remove visitor IP headers will only remove the visitor IP from the header value when Cloudflare receives a request proxied by at least another CDN (content delivery network). In this case, Cloudflare will only keep the IP address of the last proxy.

For example, consider an incoming request proxied by two CDNs (CDN_1 and CDN_2) before reaching the Cloudflare network. The x-forwarded-for header would be similar to the following:
x-forwarded-for: <VISITOR_IP>, <THIRD_PARTY_CDN_1_IP>, <THIRD_PARTY_CDN_2_IP>

With Remove visitor IP headers enabled, the x-forwarded-for header sent to the origin server will be:
x-forwarded-for: <THIRD_PARTY_CDN_2_IP>

Add leaked credentials checks header

Adds an Exposed-Credential-Check request header whenever the WAF detects leaked credentials in the incoming request.

The header can have these values:

Header + Value Description Availability
Exposed-Credential-Check: 1 Previously leaked username and password detected Pro plan and above
Exposed-Credential-Check: 2 Previously leaked username detected Enterprise plan
Exposed-Credential-Check: 3 Similar combination of previously leaked username and password detected Enterprise plan
Exposed-Credential-Check: 4 Previously leaked password detected All plans

You will only receive this managed header at your origin server if:

Add malicious uploads detection header

Adds a Malicious-Uploads-Detection request header indicating the outcome of scanning uploaded content for malicious signatures.

The header can have one of the following values:

Header + Value Description
Malicious-Uploads-Detection: 1 The request contains at least one malicious content object (cf.waf.content_scan.has_malicious_obj is true).
Malicious-Uploads-Detection: 2 The file scanner was unable to scan all the content objects detected in the request (cf.waf.content_scan.has_failed is true).
Malicious-Uploads-Detection: 3 The request contains at least one content object (cf.waf.content_scan.has_obj is true).

For more information, refer to Malicious uploads detection.

HTTP response headers

Remove "X-Powered-By" headers

Removes the X-Powered-By HTTP response header that provides information about the application at the origin server that handled the request.

Add security headers

Adds several security-related HTTP response headers. The added response headers and values are the following:

To increase protection, enable HTTP Strict Transport Security (HSTS) for your website.