Cloudflare WAF now inspects responses, not just requests, to catch exploits
In short: Cloudflare has launched full transaction detection and response rules for its web application firewall, which evaluate both the HTTP request and the origin's response to confirm whether an attack actually succeeded. Previously the WAF only inspected incoming requests, which could miss exploits that only reveal themselves in the response (e.g. leaked file contents) or create false positives when blocking based on request signatures alone. The first managed protections target the recently disclosed php2shell vulnerability, and the feature is generally available to all customers, including Free plans.
This summary was generated automatically by AI from Cloudflare Security's publication. It is our own text, not a copy of the original — facts, figures and quotes belong to the source, linked above and below.
What changed?
- 1New capability: full transaction detection correlates request and response to confirm exploitation (e.g. path traversal followed by a leaked config file in the response)
- 2Response rules can block or replace the origin's response (WAF block page, HTTP 403) before it reaches the requester
- 3New fields added: cf.waf.signature.response.confidence, cf.waf.signature.response.categories, cf.waf.signature.response.ref
- 4Managed and custom response rules are available on all plans including Free; paying customers get a richer detection catalog and access to response fields for custom rules
- 5Up to three custom response rules per customer supporting Log and Block actions; rules on response body not yet supported
- 6First managed detections target the php2shell vulnerability; broader coverage for data exposure/exfiltration planned
- 7Detection results are visible in Security Analytics and Security Events for investigation
Why it matters
Request-only WAF rules force a tradeoff between catching more attacks and generating false positives that break legitimate traffic. By correlating the request with what the origin actually returned, defenders get stronger evidence an exploit succeeded (not just was attempted), which matters as AI-driven scanning tools get better at finding and chaining vulnerabilities in web applications and APIs.
What it means for AI agents and contact centers
If any web dashboards, APIs, or admin interfaces used in contact-center or voice-agent platforms run behind Cloudflare, this adds a free layer of protection that can catch data exposure (e.g. leaked credentials, config files, PII in responses) that request-based rules alone would miss — worth reviewing Security Analytics to see if any existing endpoints would trigger these new detections.
🧪 Worth Testing
Enabling the managed response ruleset and reviewing Security Analytics costs nothing on Free plans and could surface real exposure risks in any internet-facing web apps, APIs, or CRM integrations behind Cloudflare.
Sources
- Cloudflare SecurityOfficialPrimary sourceOriginal article →„Introducing full transaction detection for Cloudflare WAF“21 Oct 2026, 17:10Licence: robots.txt Content-Signal: ai-input=yes · our summary (content changed)
- Published by source
- 21 Oct 2026, 17:10
- Found by our system
- 21 Oct 2026, 17:18
- Summary generated
- 21 Oct 2026, 17:19
This article was written by AI from the original source. Facts, numbers and prices come from the source; missing values are marked “Not specified”. Legal notice, copyright and privacy