Cloudflare has announced a significant expansion of its web application firewall (WAF) capabilities, introducing full transaction detections and response rules designed to evaluate both incoming HTTP requests and their corresponding responses. This new dual-layered approach aims to answer critical security questions simultaneously: whether an incoming request appears malicious and what actually transpired when the target application processed it. Furthermore, the newly introduced response rules empower the system to intercept and block an origin server’s response before it ever reaches the original requester.
The rollout comes at a crucial time for cybersecurity defenders. Modern frontier artificial intelligence models are increasingly adept at uncovering software vulnerabilities buried deep within widely deployed codebases. While these advancements give security teams valuable clarity on what flaws require patching, they simultaneously provide malicious actors with sophisticated, automated pathways for exploitation. The recent disclosure of the high-profile php2shell vulnerability highlights the stakes, demonstrating how a single software flaw in a common component can put countless applications across the internet at immediate risk.
Autonomous AI agents used by attackers can exhibit extreme persistence. They are capable of adapting payloads dynamically based on real-time application feedback, chaining multiple vulnerabilities together, and exploiting credentials and permissions systematically. In many scenarios, an application’s HTTP response acts as an oracle, revealing whether an attempted exploit was successful and providing attackers with the precise technical intelligence needed to dig deeper into compromised systems.
Historically, web application firewalls have relied primarily on inspecting incoming requests. While stopping recognizable attack vectors at the perimeter before they reach an origin application remains an indispensable layer of defense, request inspection alone has inherent limitations. Certain threats and exploitation attempts only become definitively apparent when a request is analyzed in direct correlation with what the origin server returns in response. A suspicious piece of input followed by an application response that exposes sensitive administrative data tells an entirely different security story than the exact same input followed by a clean rejection, a redirect, or an error code.
By correlating incoming requests with outgoing responses, Cloudflare’s updated infrastructure accounts for the real-world outcome of an entire HTTP transaction. Customers can now leverage either Cloudflare-managed protections or custom policies that combine request properties and response properties within a unified framework. Detection outcomes are fully integrated into Security Analytics to streamline forensic investigations and threat hunting. Significantly, Cloudflare has made these powerful new capabilities generally available across all customer subscription tiers, including free plans, reinforcing the company’s commitment to baseline internet security.
Request inspection is not enough
Cloudflare’s WAF has long protected websites and application programming interfaces through a combination of managed rules, custom rules, and rate-limiting controls. Managed rules offer robust protection against known attack techniques and widespread vulnerabilities, while custom rules allow internal security teams to craft tailored policies based on parameters such as source IP addresses, URL paths, HTTP headers, and request bodies. These traditional controls operate strictly at the request level to halt exploits and unwanted traffic before they reach the origin infrastructure.
For a wide variety of standard threats, request-level intervention is the correct approach. However, treating every suspicious request as a confirmed, successful exploit forces security teams into a difficult balancing act. Broad request signatures can catch a higher volume of potential attacks, but they frequently generate false positives by incorrectly flagging legitimate user traffic, which can inadvertently break functional applications. Conversely, deploying strictly conservative rules that minimize false positives reduces operational risk but leaves a wider margin of ambiguity, allowing more suspicious or sophisticated traffic to reach backend servers.
The HTTP response provides the missing piece of evidence required to resolve this ambiguity. By correlating the response with the request that triggered it, security systems can evaluate the actual impact of an event.
Consider a common scenario where an application allows users to download files, and an adversary manipulates the file parameter to request a private configuration file residing outside the permitted directory structure. A standard request inspection engine can easily recognize this path traversal attempt and block it upstream. However, the request payload alone cannot establish whether the application is actually vulnerable or if it will expose the file. The origin server might safely reject the request, ignore the traversal sequence, or return a standard application error.
If the request successfully reaches a vulnerable origin, the resulting response provides concrete evidence of compromise, such as database credentials or internal system configuration details. Full transaction detection bridges this visibility gap by correlating the attempted file access with response content characteristics that typify sensitive data exposure. Because configuration-like text can occasionally appear legitimately in documentation or example downloads, combining the traversal attempt with the matching response content provides a far higher degree of evidentiary certainty than either signal alone. Once identified, a response rule can replace the origin’s response with a standard WAF block page and an HTTP 403 status code, stopping the exploit by preventing sensitive information from reaching the attacker.
Detection and mitigation are separate by design
Full transaction detection extends Cloudflare’s always-on detection framework by strictly separating traffic analysis from mitigation actions. Detections analyze traffic streams, identifying patterns and attaching relevant metadata to both requests and responses. Rules then evaluate this metadata to determine the appropriate course of action.
This architectural separation gives security teams deep visibility into their traffic before they commit to enforcing active blocking policies. Administrators can inspect detections within their environment, understand which endpoints and signatures are actively involved, and choose a response strategy tailored to their specific application architecture. The outcomes of these detections are recorded in dedicated fields that can be accessed via response custom rules or leveraged directly by managed detections to block malicious traffic.
To support this expanded framework, new metadata fields have been added to the platform to capture confidence values associated with matching signatures, specific vulnerability categories, and up to ten signature reference IDs. The initial wave of full transaction detections focuses specifically on exploit confirmation for high-profile vulnerabilities, correlating suspicious inputs with response indicators that suggest an exploit has succeeded. Over time, Cloudflare plans to expand this coverage to include additional use cases, such as detecting data exposure and active exfiltration signals. This capability is particularly vital for organizations that lack dedicated security personnel to continuously tune individual WAF rules.
Create rules on the response
Detecting evidence of exploitation in real time is most effective when paired with immediate inline mitigation. Response custom rules allow security teams to combine request properties, response properties, and detection results to decide which origin responses should be blocked before reaching the end user. When a blocking rule matches, Cloudflare intercepts the response and substitutes it with a WAF block page or a customized error response.
These response phase controls are accessible directly within the Cloudflare dashboard under the security settings, encompassing both managed protections and custom rules. All customer accounts can utilize managed protections and create up to three custom response rules supporting log and block actions. For managed detections, all users benefit from the Cloudflare Managed Response Firewall Default ruleset, which is engineered for straightforward deployment and enables automated response blocking upon signature matches. Customers retain the flexibility to edit the scope of these managed rules, restricting detection logic to specific application paths or subdomains to minimize any risk of false positives.
Custom response rules provide advanced engineering teams with granular control over rule logic. For instance, an administrator can construct a policy to prevent an administrative interface from being exposed externally when an upstream authentication gateway fails to mark a request as internal. By evaluating criteria such as the URL path, internal user headers, HTTP response status codes, and content types, organizations can ensure that rules trigger only when an unauthenticated request successfully returns a target HTML administration page, ignoring ordinary login failures, redirects, or unrelated user traffic.
Investigating matching requests
When a managed or custom response rule logs or blocks a transaction, the corresponding event is recorded within the platform’s Security Events interface. This centralized logging ensures that incident responders can trace any detection back to the full contextual history of the request, the content of the response, and the specific rule identifier that initiated the action.
Events generated by response rules are integrated into the existing Managed Rules and Custom Rules monitoring services, allowing administrators to filter and review events associated with specific rule IDs. Full transaction detection is now generally available for all web properties and zones proxying traffic through Cloudflare, providing organizations with an advanced layer of application security that bridges the gap between perimeter inspection and backend visibility.
