Cloudflare has announced a major expansion of its web application firewall (WAF) platform, introducing two critical capabilities designed to shift how organizations defend their applications: full transaction detections and response rules. This dual-layered approach allows the security platform to evaluate incoming HTTP requests alongside the corresponding responses generated by the application. By analyzing both sides of the communication, the updated firewall can accurately answer two fundamental operational questions during an incident: whether an incoming request looks malicious, and precisely what transpired when the application handled it. Furthermore, the newly introduced response rules enable the system to intercept and block an origin server’s response before it ever reaches the requesting party.
These enhancements arrive at a time when the threat landscape is shifting rapidly, driven in part by sophisticated automated actors. The latest frontier AI models are actively uncovering software vulnerabilities buried deep within widely deployed applications. While this visibility helps defenders identify what needs to be patched, it simultaneously provides malicious actors and autonomous AI agents with novel, highly efficient pathways for exploitation. Modern AI-powered tools are exceptionally persistent, dynamically adapting attack payloads based on real-time feedback, and successfully chaining distinct vulnerabilities, stolen credentials, and permission flaws together. Recent high-profile security events, such as the disclosure of the php2shell vulnerability, vividly illustrate these stakes, demonstrating how a single flaw in a common software component can instantly place countless applications across the global internet at immediate risk. In such scenarios, an application’s response can inadvertently confirm whether an attack attempt succeeded, providing malicious actors with the precise feedback needed to probe deeper.
Inspecting incoming traffic at the perimeter remains an essential pillar of modern cybersecurity, as it allows automated systems to stop recognizable attack signatures before they ever touch an application’s core infrastructure. However, a significant category of security threats can only be definitively recognized when an incoming request is evaluated in direct context with what the origin server returns. A suspicious input followed by a server response that inadvertently exposes sensitive internal information tells an entirely different security story than the exact same input followed by a standard rejection, a redirection, or an error code.
With the deployment of these new features, customers are empowered to leverage Cloudflare-managed protections or construct custom security policies that seamlessly combine both request and response properties. This development significantly extends the platform’s always-on application security framework, with all detection results feeding directly into Security Analytics to streamline forensic investigations. The first managed protections utilizing this advanced capability have been built specifically to address the recently disclosed php2shell vulnerability. Crucially, Cloudflare is making these advanced capabilities generally available across all service tiers, including its Free plans, ensuring that sophisticated application defense is not restricted to enterprise budgets.
Request Inspection Is Not Enough
Cloudflare’s established WAF protects websites and APIs using a combination of managed rules, custom rules, and rate-limiting controls. Managed rules deliver pre-packaged protection against known attack techniques and emerging vulnerabilities, while custom rules allow internal security teams to craft bespoke policies using parameters such as source IP addresses, URL paths, request headers, and request bodies. Historically, these controls operated strictly at the request level to stop exploits or unwanted traffic from reaching the origin server.
For a broad spectrum of threats, perimeter request inspection remains the appropriate operational layer to take defensive action. Yet, treating every single suspicious request as a confirmed exploit presents security engineers with a difficult operational trade-off. Broad request signatures can capture a higher volume of potential attacks, but they inherently carry a higher risk of generating false positives—erroneously matching legitimate, benign traffic, which can inadvertently break application functionality. Conversely, deploying strictly conservative rules that never trigger false positives reduces operational risk but leaves a wider security gap, allowing ambiguous traffic to reach the backend server unhindered.
The application’s response provides the vital missing evidence needed to bridge this gap. By correlating the response with the specific request that generated it, Cloudflare enables detections to account for the actual outcome of the entire HTTP transaction.
Consider an illustrative scenario involving an application that permits users to download files. A malicious actor might manipulate the file parameter within the request URL in an attempt to access a private configuration file residing outside the permitted directory structure, issuing a request such as a directory traversal payload targeting a database configuration file. Traditional request inspection can recognize the path traversal pattern and block the transaction before it reaches the application layer. However, the request alone cannot definitively establish whether the underlying application is actually vulnerable and would expose the file; the application might reject the request, ignore the traversal characters entirely, or return a standard application error. If the request successfully reaches the origin and the server returns a successful status code alongside database credentials, the response supplies the definitive evidence of exploitation.
Full transaction detection provides the missing piece of the puzzle by correlating the attempted file access with response content characteristic of a sensitive private configuration file. Because configuration-like text can occasionally appear legitimately in documentation or example downloads, combining the text with a traversal attempt provides vastly stronger evidence of data exposure than either signal evaluated in isolation. A response rule can then intervene, replacing the origin response with a standard WAF block page and an HTTP 403 status code before it reaches the requester, effectively neutralizing the exploit by preventing sensitive information from leaking.
Detection and Mitigation Are Separate by Design
Full transaction detection extends the always-on detection framework that Cloudflare introduced earlier in the year. Under this architecture, detections analyze live traffic and attach structured metadata to both the request and response, while separate rules determine the appropriate mitigation action based on those results.
Separating detection from mitigation provides security teams with essential visibility before they enforce rigid policies. Security professionals can inspect detection data within their live traffic streams, understand which specific endpoints and attack signatures are involved, and subsequently choose a response policy tailored to their application’s architecture. The outcomes of these detections are stored in dedicated fields that can be accessed in custom response rules or utilized by managed detections to block malicious traffic automatically.
The platform introduces specific new response fields to mirror existing request detection capabilities, including fields for tracking associated signature confidence values, matching signature categories, and signature reference IDs. The initial rollout of full transaction detections focuses primarily on exploit confirmation for high-profile vulnerabilities, correlating suspicious inputs directly with response signals that indicate a successful breach.
Over time, coverage will expand to encompass additional security use cases, including the detection of data exposure and exfiltration signals. This expansion benefits the wider internet ecosystem by allowing security defenses to reliably distinguish harmless probing from tangible evidence of impact, while simultaneously extending robust data protection to customers who may not employ a dedicated security team to manually tune individual WAF rules.
Create Rules on the Response
Detecting evidence of exploitation delivers maximum value when security systems can act upon it in real time. Response custom rules transform full transaction detections into inline protections by blocking matching origin responses before they reach the requester, although they cannot retroactively undo actions already executed at the origin server.
Security teams can now combine request and response attributes with detection analytics to determine precisely which responses warrant a block. When a blocking rule evaluates to true, Cloudflare substitutes the origin response with a customized WAF block page or a designated custom response. These response phase controls are located within the Cloudflare dashboard under security rules, encompassing both managed protections and custom rules.
Both managed and custom rules are available across all account plans, including Free tiers. For future expansions, Cloudflare intends to follow its established model for request detections, where managed protections on free plans focus heavily on high-profile vulnerabilities, while paying subscribers gain access to an expanded catalog of specialized detections.
Managed Detections
All customers receive baseline protection through the Cloudflare Managed Response Firewall Default ruleset, which is engineered for straightforward, one-click deployment and simplified administration. When a signature match occurs, the managed detection blocks the response and returns a standard WAF block page. Administrators can edit the scope of this ruleset to run detections on specific portions of their applications, such as restricting enforcement to particular URL paths. Paying subscribers can further leverage detection fields within custom response rules to build highly granular policies.
Custom Rules
Custom response rules provide organizations with complete control over evaluation logic. For instance, an administrator can deploy a rule designed to prevent an internal administration interface from being exposed to the public internet when an authentication gateway fails to mark the incoming request as internal. By evaluating criteria such as the URI path, internal user headers, HTTP response codes, and content types, such a rule ensures that the system blocks traffic only when an unauthenticated request targets an administrative endpoint and the origin server actually returns a successful HTML page, avoiding false blocks on ordinary authentication failures or non-administration traffic.
All customers are able to create up to three custom response rules supporting logging and blocking actions. The available fields and functions mirror those already accessible in request custom rules, though processing rules directly on the response body is not yet supported. Paying subscribers also gain access to signature response outcome fields, which can be combined with hostnames, URL paths, source IP addresses, and request headers to enforce precision security on single paths or limit policies to specific application contexts.
Investigating Matching Requests
When a managed or custom response rule logs or blocks a transaction, the resulting event is logged in Security Events. This integration allows incident responders to trace any detection back to the full context of the request alongside the specific rule that triggered the mitigation. Currently, request-only rules and full-transaction rules appear together within the same analytics interface, where events generated by response rules are classified under managed or custom rules services, allowing administrators to filter events by specific rule IDs.
Full transaction detection is available for all web properties proxying traffic through Cloudflare. Security teams can verify their protection status within the security settings of the Cloudflare dashboard, review detection analytics, and establish response-phase security policies tailored to their operational requirements.
Leave a Reply