What changed
On October 21, 2026 Cloudflare launched full-transaction WAF detection and response-phase rules across all plans. The system correlates HTTP request and origin-response signals, allowing managed detections to identify evidence of successful exploitation and block the response before the requester receives it. All plans, including Free, can deploy managed protections and create up to three custom response rules with Log and Block actions. Initial managed signatures address PHP2Shell; richer detection fields are available to paying customers.
Why it matters
Traditional request-only WAF rules may flag a suspicious path but cannot determine whether an origin actually returned private data. Combining request and response evidence can reduce ambiguity, allow narrower protections and prevent some sensitive responses from reaching an attacker. However, it cannot reverse a command or database write already performed at the origin. It must complement rather than replace application and PHP security patches.
Full transaction evidence
Cloudflare evaluates suspicious request characteristics alongside response status, headers and detection signals. A traversal attempt followed by a response resembling a private configuration file is stronger evidence of exposure than the same request returning an error. Detections appear in Security Analytics and can feed managed response policies.
Blocking after origin execution
A response-phase rule can replace the origin response with an HTTP 403 WAF block page. That limits data reaching the requester but cannot undo an action already executed by the application. The first managed response signatures include PHP2Shell.
Availability and limits
Cloudflare says the managed response firewall and custom response rules are generally available for all plans, including Free. Customers can create up to three custom response rules with Log and Block actions. Custom response-body matching is not yet supported. Paid plans receive richer cf.waf.signature.response confidence, category and reference fields, with rollout ongoing.
Deploy conservatively
Review Security Analytics and Security Events, verify the managed response firewall ruleset, and start with narrow scopes and logging where legitimate traffic could be affected. Confirm that the PHP2Shell and other origin vulnerabilities are patched; a response-phase WAF is not a complete mitigation.
What remains unverified
Cloudflare's primary release describes capabilities and plan access, but there is no independent large-scale measurement of false positives or effectiveness. Initial detections focus on high-profile exploitation, and response-body custom rule matching remains unavailable.