Your WAF Now Sees Responses Too: Cloudflare Introduces Full Transaction Detection

Hi everyone, Shii-chan here! Your WAF can now look at the response you send back, not just the request coming in. Let's take a look.

Cloudflare Blog blog.cloudflare.com

What was announced?

The Cloudflare Blog announced two new WAF capabilities: full transaction detections and response rules. Both are generally available to all customers, including Free plans, for all zones proxying traffic through Cloudflare.

Why it matters

The post ties the release to AI-driven vulnerability discovery. Attackers can use AI agents that adapt payloads based on feedback and chain vulnerabilities, credentials, and permissions. It cites the recent php2shell vulnerability as an example of a flaw in a common software component putting many applications at risk.

An application's response can show whether an exploit worked, and it may give an attacker information for going deeper.

The story so far

Request-only inspection has limits:

• Broad request signatures catch more potential attacks but can produce false positives that break legitimate applications
• Narrow rules avoid false positives but let more ambiguous traffic reach the origin server

Correlating the request with its response adds the missing evidence about what the application actually did.

What changes

Here's the article's example. An application serves files based on a file parameter. A path traversal request targeting a configuration file can be recognized from the request alone, but that doesn't show whether the file was exposed. If the request reaches the origin and returns a 200 OK containing credential-style configuration text, the combination is much stronger evidence of data exposure. A response rule can then replace the origin response with a WAF block page and an HTTP 403.

Dive Deep

Detection and mitigation are separate

• Detections analyze traffic and attach metadata to requests and responses. Rules then decide what action to take
• You can review detections in Security Analytics before writing a policy
• Detection results are exposed through new response-phase fields:

Detection coverage

The first full transaction detections target exploit confirmation for high-profile vulnerabilities, pairing suspicious input with response signals suggesting an exploit may have succeeded. Cloudflare plans to add detection for data exposure and exfiltration signals.

Response rules

• They can block an origin response before it reaches the requester, but cannot undo actions the origin has already performed
• When a block rule matches, Cloudflare substitutes a WAF block page or a custom response
• Response-phase controls are at the bottom of the Security > Security Rules page

Managed protection and custom rules

• The Cloudflare Managed Response Firewall Default ruleset offers one-click deployment and runs on every request by default. When a signature matches, it blocks the response and returns a standard WAF block page. You can narrow its scope, such as by excluding or restricting paths, to reduce false-positive risk
• Free-plan managed detections focus on high-profile vulnerabilities, while paid plans get a broader detection catalog over time
• All customers can create up to three custom response rules with Log or Block actions. Response-body rules are not yet available
• Paid customers can use the cf.waf.signature.response.* fields, combined with hostname, path, source IP, or headers. These fields are rolling out gradually, so contact your account team if you don't have access
• The article's custom rule example blocks unauthenticated requests to /admin when the origin returns a successful HTML page, leaving ordinary authentication failures, redirects, and unrelated traffic alone

Investigation

Events from managed and custom response rules appear in Security Events, under the Managed Rules or Custom Rules service. You can filter by rule ID, and request-only and full-transaction rules appear together in the same analytics view.

Wrap-up

• Full transaction detections and response rules, which correlate requests with responses, are GA on all plans
• Origin responses can be blocked before they reach the requester, helping prevent data exposure
• All customers get up to three custom response rules; detection fields are for paid plans
• The first detections confirm exploit success for high-profile vulnerabilities

If you run web applications and want to reduce false positives while still guarding against data exposure, this one's for you!