---
title: Require specific HTTP headers · Cloudflare Web Application Firewall (WAF) docs
description: Many organizations qualify traffic based on the presence of specific HTTP request headers. Use the Rules language HTTP request header fields to target requests with specific headers.
lastUpdated: 2025-02-26T21:04:27.000Z
source_url:
  html: https://8f4f2dac.preview.developers.cloudflare.com/waf/custom-rules/use-cases/require-specific-headers/index.md
  md: https://8f4f2dac.preview.developers.cloudflare.com/waf/custom-rules/use-cases/require-specific-headers/
---

Many organizations qualify traffic based on the presence of specific HTTP request headers. Use the Rules language [HTTP request header fields](https://developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/?field-category=Headers\&search-term=http.request) to target requests with specific headers.

## Example 1: Require presence of HTTP header

This example uses the [`http.request.headers.names`](https://developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.headers.names/) field to look for the presence of an `X-CSRF-Token` header. The [`lower()`](https://developers.cloudflare.com/ruleset-engine/rules-language/functions/#lower) transformation function converts the header name to lowercase so that the expression is case-insensitive.

When the `X-CSRF-Token` header is missing, Cloudflare blocks the request.

* **Expression**: `not any(lower(http.request.headers.names[*])[*] eq "x-csrf-token") and (http.request.full_uri eq "https://www.example.com/somepath")`
* **Action**: *Block*

## Example 2: Require HTTP header with a specific value

This example uses the [`http.request.headers`](https://developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/http.request.headers/) field to look for the presence of the `X-Example-Header` header and to get its value (if any). The keys in the `http.request.headers` field, corresponding to HTTP header names, are in lowercase.

When the `X-Example-Header` header is missing or it does not have the value `example-value`, Cloudflare blocks the request.

* **Expression**: `not any(http.request.headers["x-example-header"][*] eq "example-value") and (http.request.uri.path eq "/somepath")`
* **Action**: *Block*

In this example the header name is case-insensitive, but the header value is case-sensitive.
