Cloudflare Adds Full Transaction Detection to WAF for All Plans

Cloudflare announced the general availability of full transaction detection for its web application firewall, enabling the service to correlate HTTP requests with their corresponding responses. This capability allows the platform to evaluate whether an application successfully processed a malicious request, providing evidence of exploitation that request-only inspection cannot detect. The update applies to all customers, including those on Free plans.

The new feature addresses limitations in traditional request-level inspection, which often struggles to distinguish between blocked attempts and successful exploits. By analyzing the origin’s response alongside the incoming request, Cloudflare can identify sensitive data exposure or risky misconfigurations. Response rules can now block the origin’s response before it reaches the requester, adding a layer of protection against successful attacks.

Context and Background

Traditional web application firewalls primarily inspect incoming requests to stop recognizable attacks before they reach the application. However, this approach can create false positives when broad signatures match legitimate traffic, potentially breaking applications. Conversely, deploying only strict rules to avoid false positives may allow ambiguous traffic to reach the server, leaving vulnerabilities unaddressed. The response provides the missing evidence needed to confirm whether an exploit succeeded.

Cloudflare notes that inspecting requests remains essential for stopping known threats, but some dangers become clear only when the request is considered alongside what the origin returns. A suspicious input followed by a response exposing sensitive information indicates a different outcome than the same input followed by a rejection or error. Correlating these two signals provides stronger evidence of sensitive data exposure than either signal alone.

Who Is Affected

This update affects all Cloudflare customers, as the new capabilities are generally available across all plan tiers, including Free accounts. Organizations using Cloudflare-managed protections or building custom policies can now combine request and response properties to enhance their security posture. Detection results are available in Security Analytics to support investigation and incident response efforts.

The initial managed protections using this capability address the recently disclosed php2shell vulnerability, a flaw in a common software component that puts applications across the Internet at risk. Cloudflare states that the latest frontier models are uncovering vulnerabilities in widely used software, giving attackers new paths to exploit. AI agents scanning for vulnerabilities can be persistent, adapting payloads using feedback and chaining vulnerabilities, credentials, and permissions.

What should you do?

Security teams should review their current WAF policies to incorporate request-response correlation where possible. Monitoring detection results in Security Analytics can help identify successful exploits that were previously missed. Organizations should also assess their exposure to recently disclosed vulnerabilities, such as php2shell, and ensure their WAF rules are updated to leverage these new capabilities.

What to do and how to stay safe: Cloudflare

• Review current WAF policies to incorporate request-response correlation for better exploit detection.
• Monitor Security Analytics for detection results that indicate successful exploitation or data exposure.
• Assess exposure to recently disclosed vulnerabilities and update WAF rules to leverage new capabilities.
• Ensure response rules are configured to block sensitive data from reaching requesters when necessary.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is full transaction detection in Cloudflare WAF?

Full transaction detection evaluates each HTTP request alongside its response to identify evidence of exploitation, helping determine if an attack succeeded.

Is this feature available to all Cloudflare customers?

Yes, Cloudflare is making full transaction detection and response rules generally available to all customers, including those on Free plans.

How does this help with the php2shell vulnerability?

Cloudflare’s first managed protections using this capability address the php2shell vulnerability, helping detect and block successful exploits of this flaw.