Cloudflare WAF adds response blocking and request-response detection

Cloudflare announced full transaction detection and response rules for its web application firewall on October 21, making the capabilities generally available across plans, including Free. Detections correlate an HTTP request with the application’s response, while response rules can stop a matching origin response before it reaches the requester. The firewall now gets to read the reply.

For applications and APIs proxying traffic through Cloudflare, the practical benefit is evidence about what a suspicious request actually produced. The company says response blocking can withhold exposed information, but cannot undo actions already performed at the origin. That limitation matters: preventing delivery of a response does not reverse an application’s earlier work.

Customers can create up to three custom response rules with Log and Block actions, combining request and response fields. Custom rules cannot yet inspect response bodies. Cloudflare recommends reviewing detections in Security Analytics before tailoring response policies, and says response fields are still rolling out to accounts, with account teams available for access questions.