Cloudflare has expanded its web application firewall (WAF) with two new capabilities: full transaction detections and response rules. The update lets Cloudflare evaluate an HTTP request alongside the origin’s response to determine not just whether a request looks malicious, but what actually happened when the application processed it.
Traditionally, WAF rules operate only on the incoming request, using managed rules, custom rules, and rate limiting based on signals like IP address, URL path, headers, and request body. That approach stops many known exploits before they reach an origin server, but it forces a tradeoff: broad request signatures catch more attacks but risk false positives that break legitimate traffic, while narrower rules reduce false positives at the cost of letting ambiguous traffic through.
Full transaction detection addresses that gap by examining the response for evidence that an attack actually succeeded. Cloudflare’s example involves a path traversal attempt against a file download endpoint. The request alone cannot confirm whether the application exposed a private configuration file. But if the origin returns content resembling exposed credentials, correlating that response with the traversal attempt provides much stronger evidence of a real data exposure than either signal would alone.
Response rules then allow Cloudflare to block the origin’s response before it reaches the requester, replacing it with a WAF block page and an HTTP 403, effectively preventing sensitive data from reaching an attacker even after a request slipped past initial filtering.
New detection fields
The feature extends Cloudflare’s always-on detection framework, keeping detection and mitigation separate. Detections attach metadata to requests and responses, and customers decide how to act on that metadata through custom or managed rules. Three new fields are available for building response-based policies:
- cf.waf.signature.response.confidence: confidence values associated with matching signatures
- cf.waf.signature.response.categories: categories associated with matching signatures
- cf.waf.signature.response.ref: signature reference IDs, up to 10
Detection results appear in Security Analytics to support investigation, and customers can use Cloudflare-managed protections or build their own policies combining request and response properties.
First target: the php2shell vulnerability
Cloudflare’s first managed protections built on this capability address the recently disclosed php2shell vulnerability. The company says the timing matters because AI-driven scanning tools are increasingly persistent, capable of adapting payloads based on feedback and chaining together vulnerabilities, credentials, and permissions. The initial full transaction detections focus on confirming exploitation of high profile vulnerabilities, with plans to expand into data exposure and exfiltration detection over time.
The new capabilities are generally available to all Cloudflare customers, including those on Free plans.