CLOUDFLARE has announced true programmability for its Cloudflare Gateway and Data Loss Prevention (DLP) capabilities, integrating them with its edge computing platform. Moving beyond traditional static security stacks, the company introduces a new Gateway action called Forward and a new policy resource called Custom Function. The Forward action lets traffic that matches a policy be sent to a Cloudflare Worker for inline transformation, acting as proxied middleware.
Custom Functions allow the Worker to be invoked during Gateway policy evaluation to return a typed value (string, number or boolean) that can be used in rule conditions. Both features are designed to run without adding extra network hops, since Cloudflare runs the compute alongside the Gateway on the same edge infrastructure.
The two entry points serve different use cases. Forward enables traffic to be transformed in flight—altering request headers, routing decisions, or even responses from the origin—while Custom Functions provide quick, bounded, stateless data processing to extend policy logic. Examples highlighted include injecting dynamic headers based on JWT-derived data, interstitial pages with audit trails, real-time DLP alerts, and complex evaluation logic that integrates external data sources.
The article notes that Forward is in public beta and Custom Functions are planned for general availability by year’s end, with pricing aligned to standard Worker requests. Cloudflare emphasises that this programmable edge approach eliminates the need for separate proxy infrastructure and offers scalable, customisable policy evaluation at the network edge.