Cloudflare WAF adds full transaction detection and response rules for all plans

What Cloudflare added

Cloudflare has expanded its web application firewall with two new capabilities: full transaction detection and response rules. According to the Cloudflare blog, full transaction detection evaluates every HTTP request together with the response the origin sends back, so the WAF can judge not only whether a request looks malicious, but whether the application's handling of it suggests an exploit actually succeeded. Response rules complement this by letting customers intercept the origin's reply before it goes back to the client.

The first managed protections built on the new capability target the recently disclosed php2shell vulnerability, Cloudflare says.

Why request-only inspection falls short

Cloudflare's existing WAF tooling — managed rules, custom rules and rate limiting — works at the request level. The company argues this creates an awkward trade-off: broad request signatures catch more potential attacks but produce false positives that break legitimate traffic, while narrow signatures are safer but let ambiguous traffic through.

The response adds evidence the request cannot supply. Cloudflare's example is a file-download endpoint where an attacker asks for a path such as /download?file=../../config/database.ini. Request inspection can flag the path traversal attempt, but the request by itself doesn't show what the application would do — it might reject the attempt, ignore the traversal or return an error. If the reply instead comes back as plain text containing configuration-like content with database credentials, the pairing of a suspicious request with a telltale response is far stronger evidence of sensitive data exposure than either signal alone.

Detection and mitigation are decoupled

The design keeps detection and enforcement separate. Detections analyze traffic and attach metadata to requests and responses; rules then decide what happens next. Cloudflare positions this split as giving security teams visibility before they commit to a policy — detections can be examined in Security Analytics to see which endpoints and signatures show up in real traffic.

Three new response-side fields mirror the existing request detection fields: cf.waf.signature.response.confidence, cf.waf.signature.response.categories and cf.waf.signature.response.ref, which holds up to ten signature reference IDs. These fields can be referenced in response custom rules or in managed detections.

The initial detections focus on exploit confirmation for high-profile vulnerabilities, correlating suspicious input with response signals that indicate an attempt worked. Cloudflare says coverage will grow to include data exposure and exfiltration signals over time.

Blocking at the response phase

Response custom rules turn detections into inline protection: when a rule matches, Cloudflare swaps the origin's response for a standard WAF block page or a custom response. There is a limitation worth noting — the rules can stop sensitive information from reaching an attacker, but any action the origin has already performed cannot be reversed.

The controls sit in the Cloudflare dashboard at the bottom of the Security > Security Rules page. All customers, including those on Free plans, receive the Cloudflare Managed Response Firewall Default ruleset, which blocks matching responses automatically and can be scoped to specific parts of an application to reduce false positives. Paying customers can additionally build custom response rules using the detection fields. Over time, Cloudflare will mirror its approach to request detections: free plans get managed detections for high-profile vulnerabilities, while paid plans get a richer catalog.

Why it matters

Cloudflare frames the upgrade against a backdrop of AI-driven security change. Frontier models are surfacing vulnerabilities buried deep inside widely used software, and AI agents scanning for weaknesses can be persistent — adjusting payloads in response to feedback and chaining together weaknesses, credentials and permissions. An application's response often reveals whether an attempt worked, handing attackers useful information for follow-up probing.

Full transaction detection shifts the WAF's core question from "is this request suspicious?" to "did this attack succeed?" That evidence-based approach can cut false positives while catching compromises that request inspection alone would miss. And because it ships on Free plans, customers without a dedicated security team get protections that would otherwise require manual rule tuning, while the broader internet gains defenses that can distinguish probing from actual impact.