Cloudflare is expanding its web application firewall (WAF) with two new capabilities: full transaction detections and response rules. Together they shift inspection from a request-only model to one that also considers what the application actually returned, helping defenders answer both "Does this request look malicious?" and "What happened when the application handled it?"
The motivation is the shifting threat landscape. The latest frontier models are surfacing vulnerabilities buried deep in widely used software, giving defenders clarity on what to fix while handing attackers new paths to exploit. The recent php2shell vulnerability illustrates the stakes: a flaw in one common software component can put applications across the Internet at risk. AI agents scanning for vulnerabilities can be extremely persistent, adapting payloads using feedback and chaining together vulnerabilities, credentials and permissions. Because an application's response can reveal whether an attempt succeeded, it can also hand an attacker information that helps them go deeper.
The concrete additions:
- Full transaction detections evaluate each HTTP request alongside its response to identify evidence of exploitation, rather than judging the request in isolation.
- Response rules can then block the origin's response before it reaches the requester, cutting off the feedback loop attackers rely on.
- Request inspection is retained, so recognizable attacks are still stopped before they reach the origin.
For developers, the practical implication is that a malicious-looking request no longer has to be the only signal. Attack chains that only become visible once the application responds — such as probing payloads that succeed silently — can now be caught at the edge, and the origin's reply withheld. Inspecting incoming requests remains essential for stopping recognizable attacks before they reach the target, but pairing it with response analysis gives a fuller picture of exploitation attempts. Teams running WAF rules should review how response rules interact with existing request-based rules and confirm expected behavior on legitimate traffic before rolling them out broadly.