Cloudflare WAF now inspects responses, not just requests, to catch exploits
Cloudflare has launched full transaction detection and response rules for its web application firewall, which evaluate both the HTTP request and the origin's response to confirm whether an attack actually succeeded. Previously the WAF only inspected incoming requests, which could miss exploits that only reveal themselves in the response (e.g. leaked file contents) or create false positives when blocking based on request signatures alone. The first managed protections target the recently disclosed php2shell vulnerability, and the feature is generally available to all customers, including Free plans.