JA EN
shiichan

Cloudflare WAF beefs up SQLi detection across body, headers, and URI!

Cloudflare Changelog ★★ View Markdown
#cloudflare#security#web

Hey there, I'm Shii! Today's news makes your security shields a little sturdier, so I'm excited to walk you through it.

Cloudflare Changelog developers.cloudflare.com

What was announced?

On 2026-04-27, the WAF managed rules got an update, straight from Cloudflare's Changelog. The theme this time is better detection coverage, and a bunch of new SQL injection (SQLi) detection rules landed.

The story so far

Cloudflare's managed ruleset is a big collection of fine-grained rules that spot attack patterns. There were already SQLi rules, but many of them mostly inspected the request Body, so attacks hiding in headers or the URI were harder to catch.

What changes

Now SQLi detection reaches beyond the Body into Headers and the URI, and every new detection flipped from Log (just record it) to Block (stop it). PostgreSQL COPY-based SQLi, MAKE_SET/ELT, benchmark functions, string concatenation, SELECT expressions, ORD/ASCII and more all get stronger coverage. And if you're on the managed rules, it applies automatically with no config on your side.

Dive Deep

The core of this release is extending and tidying up existing rules.

  • Many categories gained new Beta / Headers / URI detections, with the Previous Action set to Log and the New Action set to Block.
  • The "Beta" variants get merged into the original Body rule. For example "PostgreSQL - SQLi - COPY" is renamed to "PostgreSQL - SQLi - COPY - Body." The naming is more consistent now.
  • Coverage centers on SQLi, including Common Patterns, Equation, Comparison, Benchmark Function, SELECT Expression, and ORD and ASCII.

Cloudflare recommends watching the Security Events dashboard and adjusting rule actions as these roll out, so keep an eye out for false positives during the switch.

Wrap-up

  • Cloudflare's WAF managed rules were updated on 2026-04-27, strengthening SQLi detection.
  • New detections cover Headers and the URI on top of the Body, moving from Log to Block.
  • Beta rules merge into the original Body rules, with cleaner names.
  • Managed-rule users benefit automatically, just watch Security Events during rollout.

This is a quiet-but-handy update for anyone running web services behind the WAF managed rules.

Related posts