Introducing full transaction detection for Cloudflare WAF
Source
blog.cloudflare.com
Date
Why it matters
The WAF can now judge a request together with the origin's response and block the response before it leaves. This targets AI-driven scanners that use response feedback to refine exploits, which request-only rules miss.
Key takeaways · AI-distilled
Cloudflare's WAF can now evaluate a request together with the origin's response, so a path-traversal attempt followed by a response that looks like a private config file counts as stronger evidence of exposure than either signal alone.
Response rules can replace a matching origin response with a 403 block page before it reaches the requester. Cloudflare notes this cannot undo actions the origin already performed; it only stops the response, including feedback an AI scanner could use to refine an exploit.
Detection and mitigation are separate: detections attach confidence, category and signature fields to the transaction, and rules decide what to do. Teams can inspect detections in Security Analytics before writing a blocking policy.
All plans, including Free, get the managed response ruleset and up to three custom response rules with Log and Block actions. Rules on the response body are not yet available, and the cf.waf.signature.response.* fields are for paying customers.
blogWe tested our own WAF with frontier AI models. Here’s what we foundblog.cloudflare.com
blogIntroducing context-aware vulnerability discovery and remediation with Cloudflare Managed Defense and OpenAI Daybreak modelsblog.cloudflare.com
articleCloudflare ranks AI-found vulnerabilities by live production exposureCloudflare