Cloudflare WAF Now Inspects Server Responses to Catch Real Exploits

Cloudflare is adding two new capabilities to its web application firewall (WAF): full transaction detection and response rules. The WAF no longer judges requests alone. It now reads each request together with the response from the origin server, and it can block that response before it reaches whoever sent the request. The feature is available to all Cloudflare customers, including the Free plan.

Why request inspection alone falls short

The backdrop is the rise of AI. The latest frontier models can uncover vulnerabilities buried deep in widely used software. That helps defenders know what to fix, but it also opens new paths for attackers. The recently disclosed php2shell vulnerability is a good example: a flaw in one common component can put applications across the Internet at risk.

AI agents that scan for vulnerabilities can be extremely persistent. They adapt payloads based on feedback and chain together vulnerabilities, credentials, and permissions. An application's response often reveals whether an attempt worked, and that information helps an attacker go deeper.

Cloudflare WAF has long protected websites and APIs through managed rules, custom rules, and rate limiting, all of which work at the request level. That creates a dilemma: broad signatures catch more attacks but can produce false positives that hit legitimate traffic and break applications. Deploying only rules that avoid false positives lowers that risk, but lets more ambiguous traffic reach the server. The response supplies the missing evidence, and Cloudflare can now correlate it with the request that produced it.

A real-world example: path traversal

Picture an application that lets users download files. An attacker manipulates the file parameter to request a private configuration file outside the permitted directory, for example GET /download?file=../../config/database.ini. Request inspection can recognize this path traversal attempt and block it. But the request alone cannot establish whether the application would expose the file. It might reject the request, ignore the traversal, or return an error.

If the request reaches the origin and the server replies with 200 OK as text/plain containing a database username and password, the evidence is clear. Full transaction detection correlates the attempted file access with response content typical of a private configuration file. Configuration-like text can legitimately appear in documentation or example downloads, but combined with a traversal attempt it is stronger evidence than either signal alone. A response rule then replaces the origin response with a Cloudflare WAF block page and HTTP 403 before it reaches the requester, so the sensitive data never gets to the attacker.

Full transaction detection and mitigation are kept separate

This feature extends the always-on detection framework Cloudflare introduced earlier this year. Detections analyze traffic and attach metadata to the request and response, while rules decide what to do with the results. Because the two jobs are separate, security teams can first inspect detections in their own traffic through Security Analytics, understand which endpoints and signatures are involved, and then pick the action that suits their application. The results are stored in fields that can be used in response custom rules or managed detections. Here are the three new fields, which mirror the request detection fields:

• cf.waf.signature.response.confidence: confidence values for matching signatures
• cf.waf.signature.response.categories: categories for matching signatures
• cf.waf.signature.response.ref: signature reference IDs, up to 10

Customers can use Cloudflare-managed protections or build their own policies that combine request and response properties. The first detections focus on exploit confirmation for a high-profile vulnerability, correlating suspicious input with response signals that suggest an exploit may have succeeded. The first managed protections target the php2shell vulnerability. Cloudflare plans to expand coverage over time, including detection of data exposure and exfiltration signals.

If you run a website or API behind Cloudflare, the feature is also available on the Free plan, so trying it doesn't require an upgrade. For small businesses without a dedicated security team, protection that can tell mere probing apart from an attack with real impact is clearly more practical.