Cloudflare WAF Enhances Security with Full Transaction Detection

Key takeaways

• Cloudflare's Web Application Firewall (WAF) now inspects both HTTP requests and their responses to detect exploitation more accurately.
• Traditional request-only inspection misses whether an exploit succeeded or sensitive data was exposed, which full transaction detection addresses.
• All Cloudflare customers, including those on Free plans, have access to these enhanced security features.
• Response rules can block malicious responses before they reach users, improving inline protection.
• Security teams can use Security Analytics to investigate incidents and customize protection policies.

What is Full Transaction Detection?

Cloudflare has introduced full transaction detection for its Web Application Firewall (WAF), which evaluates HTTP requests alongside their corresponding responses. This capability helps identify evidence of exploitation by correlating suspicious inputs with the actual application response, answering not just "Does this request look malicious?" but also "What happened after the application processed it?".

With this approach, response rules can block the origin server's response before it reaches the requester, providing inline protection that stops data exposure or exploit results in real time. This new feature extends Cloudflare's always-on application security framework by adding context from the response phase to the existing request inspection.

Why Request-Only Inspection is Insufficient

Traditional WAFs inspect only incoming HTTP requests to prevent recognizable attacks from reaching the application. While this is essential for stopping many threats, it offers incomplete protection because it cannot confirm if an exploit succeeded or if sensitive data was exposed.

For example, consider a path traversal attack where an attacker manipulates a file parameter to access sensitive files outside permitted directories. The request inspection might detect the suspicious input and block it, but if the request reaches the origin, only the response reveals if the sensitive file was actually exposed. A response containing configuration details or secret credentials indicates a successful exploit.

Full transaction detection correlates suspicious requests with response content, providing stronger evidence of exploitation or data exposure. This reduces false positives and helps security teams distinguish between blocked attacks and those that succeeded.

Who is Affected and Benefits

All Cloudflare customers, including those using Free plans, benefit from full transaction detection and response rules. Small businesses, marketers, agencies, creators, and developers relying on Cloudflare’s WAF can detect and block sophisticated exploits and data exposures that might otherwise go unnoticed.

Security teams gain enhanced visibility through Security Analytics, which provides detailed insights into detected threats, affected endpoints, and triggered rules. This enables more effective investigation and the creation of tailored protection policies suitable for different applications or business needs.

How to Use Full Transaction Detection

Cloudflare customers can leverage full transaction detection by using Cloudflare-managed protections or creating custom policies that combine request and response properties. Response custom rules allow blocking suspicious origin responses before they reach the requester, replacing them with a WAF block page.

Users can monitor all detections and blocked transactions in the Security Events dashboard, which shows full context for troubleshooting. Custom response rules support up to three rules per account with Log and Block actions. Paying customers have access to advanced detection fields such as cf.waf.signature.response.confidence and cf.waf.signature.response.categories to create more granular policies.

For example, a custom response rule might block access to an administration page if an unauthenticated request receives a successful HTML response. This prevents exposure of sensitive interfaces only when the application actually returns the protected content.

Getting Started and Next Steps

Full transaction detection is generally available for all zones proxying traffic through Cloudflare. To verify protection, users should visit Security > Security Rules in the Cloudflare dashboard.

For customization, review detections in Security Analytics and create response phase policies tailored to your application’s needs. This approach helps balance security and usability by applying blocking only when the response confirms an exploit or data exposure.

Small businesses and marketers who share links, QR codes, or WhatsApp chats can benefit from integrating these protections to secure their web assets. Using tools like branded domains, short links, and campaign tracking alongside Cloudflare’s WAF can improve overall security and trust.

What to Do Next

1. Check your Cloudflare dashboard under Security > Security Rules to confirm full transaction detection is active.
2. Review Security Analytics to understand current detections and blocked responses.
3. Create or adjust custom response rules to block suspicious responses specific to your application.
4. Monitor Security Events regularly to investigate and respond to potential threats.
5. Consider using link management features such as branded domains and short links to maintain trust and track campaign performance securely.

These steps will help businesses and marketers enhance their web security posture using the new capabilities of Cloudflare’s WAF with full transaction detection.

Sources

• Introducing full transaction detection for Cloudflare WAF — Cloudflare, 21 October 2026