Cloudflare has expanded its web application firewall with full transaction detection, allowing the service to evaluate an HTTP request together with the application’s response. The goal is to separate suspicious probes from cases where the response shows that an exploit may have succeeded.
Traditional request rules can block patterns before they reach an origin server, but broad signatures risk false positives. By adding response signals, Cloudflare says defenders can look for evidence such as private configuration data appearing after a path-traversal attempt. A response rule can then replace the origin output with a block page before the requester receives it.
Detection and blocking are separate
Cloudflare deliberately separates detection from mitigation. Full transaction detections attach metadata to the request and response, while managed or custom response rules decide what action to take. That lets security teams observe matches before enforcing a policy and scope protections to particular hostnames, paths or application contexts.
The company added response signature fields for confidence, categories and reference identifiers. Events created by managed and custom response rules appear in Security Events, where responders can trace a match to the request context and the rule that acted on it.
Available across all plans
Full transaction detection is generally available for zones that proxy traffic through Cloudflare, including customers on the Free plan. The company has also released a Managed Response Firewall Default ruleset intended to provide a simpler deployment path. Paying customers can use detection fields in custom response rules for more tailored controls, although Cloudflare said those fields are still rolling out to all accounts.
The first managed use case focuses on the recently disclosed php2shell vulnerabilities. Cloudflare says correlating suspicious input with response evidence can confirm exploitation and stop exposed data from leaving the edge. The company also cautions that blocking a response cannot undo actions already completed on the origin server, so patching vulnerable software and investigating affected systems remain necessary.
For operators, availability on every plan does not remove the need for careful rollout. A response-body rule can prevent leaked material from reaching a requester, but overly broad response matching could still interrupt legitimate traffic. Security teams should review detections in analytics, test the managed ruleset on representative endpoints, narrow policies where appropriate and continue monitoring the origin for any actions an attacker may have triggered before the response was blocked.
Cloudflare said it plans to broaden the detection catalog over time, including more signals for data exposure and exfiltration.
Source: Cloudflare WAF announcement.
Featured image: AI-generated editorial illustration; not a photograph of a real cyberattack.
