Cloudflare WAF Adds Full Transaction Detections and Response Rules

Expanded WAF Capabilities

Cloudflare has enhanced its Web Application Firewall (WAF) with two new features: full transaction detections and response rules. Full transaction detections analyze both the HTTP request and its corresponding response to identify signs of exploitation. This allows the WAF to determine if a request is malicious and how the application handled it.

Addressing Evolving Threats

These new capabilities are designed to counter vulnerabilities being discovered by advanced models, which attackers can exploit. The php2shell vulnerability is cited as an example where a flaw in common software can put applications at risk. AI agents can persistently scan for vulnerabilities, adapt payloads, and chain exploits, making it crucial to understand application responses.

Combined Request and Response Analysis

While inspecting incoming requests remains important, some threats only become apparent when the request is considered with the application's response. For instance, a suspicious input followed by a response revealing sensitive information indicates a different threat level than the same input followed by an error or rejection. The new features allow customers to use Cloudflare-managed protections or create custom policies based on both request and response properties.

Availability and Impact

These new WAF capabilities are now generally available to all Cloudflare customers, including those on Free plans. Detection results are accessible in Security Analytics for investigation. The first managed protections utilizing this functionality specifically address the recently disclosed php2shell vulnerability.