Cloudflare Introduces Full Transaction Detection and Response Rules for WAF

Overview of Full Transaction Detection

Cloudflare has expanded its web application firewall (WAF) by adding full transaction detections and response rules. Written by Daniele Molteni, Elie Roudninski, and Nick Downie, the update evaluates each HTTP request alongside its corresponding response to identify evidence of exploitation. This helps answer whether a request looks malicious and what happened when the application handled it. Response rules can then block the origin's response before it reaches the requester. These features are generally available to all Cloudflare customers, including Free plans.

The Need for Request and Response Correlation

While inspecting incoming requests is essential for stopping recognizable attacks, some threats only become clear when the request is considered alongside what the origin returns. The source notes that frontier models are uncovering vulnerabilities deep in software, such as the recent php2shell vulnerability, and AI agents are persistently scanning for weaknesses. Broad request signatures can catch potential attacks but risk creating false positives that break legitimate applications. Correlating the request with the response provides the missing evidence needed to confirm whether an exploit succeeded.

Detection and Mitigation Separation

Cloudflare's full transaction detection separates analysis from action. Detections analyze traffic and attach metadata to the request and response, while rules decide how to handle the results. New platform fields have been added: cf.waf.signature.response.confidence and cf.waf.signature.response.categories. Security teams can inspect these detections in Security Analytics to understand which endpoints and signatures are involved before designing a policy.

Response Custom Rules and Managed Protections

Customers can use Cloudflare-managed protections or build custom policies combining request and response properties. All customers receive protection through the Cloudflare Managed Response Firewall Default ruleset, and can create up to three custom response rules supporting Log and Block actions. Paying customers have access to additional custom response capabilities using the response signature fields. When a rule matches, Cloudflare replaces the origin response with a WAF block page or a custom response, and events are recorded in Security Events.