Introducing full transaction detection for Cloudflare WAF
- ID
- 37905
- Status
- summarized
- Published
- 21 Oct 2026, 10:10 PM
- Fetched
- 21 Oct 2026, 11:48 PM
- Provider
- Cloudflare Blog
- Category
- infrastructure
- Original URL
- https://blog.cloudflare.com/full-transaction-waf/
- Source URL
- https://blog.cloudflare.com/rss/
Summary
- Score
- 4.0
- Created
- 21 Oct 2026, 11:49 PM
- Tags
- Audience
- developersvibe_coderssaas_founders
What happened
Cloudflare WAF added full transaction detections, which evaluate each HTTP request together with its response, plus response rules that can block an origin response before it reaches the requester. The capabilities are generally available to all Cloudflare customers, including Free plans, and the first managed protections target the recently disclosed php2shell vulnerability.
Why it matters
If you run an app behind Cloudflare, the Free-plan GA means you can decide whether to enable the managed php2shell detections or write custom rules that combine request and response properties. The post gives no independent false-positive or latency data, so test on staging before broad rollout.
Discussion angle
For those on Cloudflare Free, what would you actually turn on first: the managed php2shell rules, custom response rules, or wait for independent false-positive data?