CLOUDFLARE has expanded its web application firewall (WAF) with two new capabilities: full transaction detections and response rules. Full transaction detections assess each HTTP request together with the origin’s response to identify evidence of exploitation, answering not only whether a request looks malicious but also what happened when the application handled it.
Response rules allow the WAF to block the origin’s response before it reaches the requester, providing inline protection based on the combined request/response signals. This aims to give defenders clearer insight into whether an attack succeeded and what sensitive information might have been exposed.
The update is positioned as part of Cloudflare’s broader, always-on application security framework. The first focus is on exploiting high-profile vulnerabilities, with the php2shell vulnerability cited as an example of why correlating request signals with response content matters. Detections attach metadata to requests and responses, and rules can act on those results to block traffic or return a WAF block page.
Access to the new response fields cf.waf.signature[.]response.* enables combining detection outcomes with other context (such as hostname or path) to tailor protections. Cloudflare notes that full transaction detections are generally available to all zones, including Free plans, and provides managed and custom response rules to help teams control protections without compromising legitimate traffic.