JA EN
shiichan

Cloudflare's WAF gets a new weapon: Application Profiles!

Cloudflare Changelog ★★★ View Markdown
#cloudflare#security

Hi, I'm Shii-chan! Today's news got me excited: Cloudflare just gave its WAF a new teammate. I love announcements about tools that learn the "correct shape" of things and protect you based on that!

Cloudflare Changelog developers.cloudflare.com

What was announced?

This comes from Cloudflare's Changelog. Cloudflare added a new defense layer to its WAF called Application Profiles. The first available profile type is Schema Profiles, which learns what a correct request looks like for your application, covering path variables, query parameters, headers, cookies, JSON bodies, and form-encoded bodies. Once learning finishes, an always-on detection engine kicks in and classifies every request as conforming or non-conforming automatically. Nothing gets blocked at this stage.

Why it matters

Traditional WAFs mostly rely on negative security: they know what attack patterns look like, and they block anything that matches. The catch is that this struggles against attacks nobody has seen before. Application Profiles flips that around: it first learns what a correct request should look like, then flags anything that deviates from that baseline. Because it doesn't depend on known attack signatures, it can catch unusual or unexpected ways attackers might try to bend your API.

What changes

The big win here is that teams running APIs or web apps can finally see whether unexpected parameters or types are showing up in their traffic. Since nothing gets blocked automatically, you can review conformance trends and sampled violations in Profile Analysis inside Security Analytics before deciding what to do. Once you're ready, you turn on enforcement with a Custom Rule, scoped by hostname, path, or operation, and you can even combine it with other signals like Attack Score.

Dive Deep

  • What Schema Profiles learn: path variables, query parameters, headers, cookies, JSON bodies, and form-encoded bodies
  • Field-level modeling: numeric ranges, string lengths, and character classes are all captured
  • The learning unit is an "operation" — an endpoint defined by HTTP method, hostname pattern, and path pattern. Web Assets discovers these continuously, and you can also add them manually
  • Once a profile is ready, always-on detection starts classifying requests as conforming or non-conforming, without blocking traffic yet
  • You review conformance trends and sampled violation details in Profile Analysis (part of Security Analytics), then move enforcement into a Custom Rule
  • Customers who already have API Security get this today through Schema Learning and Schema Validation
  • Enterprise customers without API Security can join a closed beta by invitation — reach out to your Cloudflare account team if you're interested

Wrap-up

  • Cloudflare added Application Profiles, a positive-security layer, to its WAF
  • The first profile type, Schema Profiles, learns the structure of paths, query strings, headers, cookies, and JSON/form bodies
  • After learning, it classifies traffic as conforming or not without blocking, and you can review it safely in Security Analytics
  • Enforcement happens through a Custom Rule, scoped by hostname, path, operation, or signals like Attack Score
  • API Security customers can use it today; other Enterprise customers can join the closed beta

This one's especially for anyone running APIs or web apps on Cloudflare who's responsible for keeping them safe!

Related posts