Introducing full transaction detection for Cloudflare WAF

{
  "id": "9d3a28e1d2d1edfbbab94ad7e2f7e01fae865b1c3982c6810302628204518dcc",
  "url": "https://blog.cloudflare.com/full-transaction-waf/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "Introducing full transaction detection for Cloudflare WAF",
    "summary": "Cloudflare has made full transaction detections and response rules generally available to all customers. The capabilities correlate HTTP requests with origin responses to detect evidence of exploitation and can block matching responses before they reach requesters. Initial managed protections address php2shell.",
    "evidence": "Today, we are expanding our web application firewall (WAF) by adding two new capabilities: full transaction detections and response rules.",
    "products": [
      {
        "name": {
          "value": "Cloudflare WAF",
          "evidence": "Cloudflare WAF protects websites and APIs with managed rules, custom rules, and rate limiting."
        },
        "prerequisites": [
          {
            "value": "all zones proxying traffic through Cloudflare",
            "evidence": "Full transaction detection is generally available for all zones proxying traffic through Cloudflare."
          },
          {
            "value": "including Free plans",
            "evidence": "We have released both managed and custom rules to all plans, including Free plans."
          }
        ],
        "fixed_versions": [
          {
            "value": "generally available",
            "evidence": "Full transaction detection is generally available for all zones proxying traffic through Cloudflare."
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-cloudflare-blog",
  "document_id": 23417,
  "published_at": "2026-10-21T14:10:42+00:00"
}