# Cloudflare WAF can now correlate malicious requests with origin responses and block the reply Cloudflare's full-transaction WAF detections and response-phase rules are generally available across plans, including Free. They can block a response that reveals evidence of successful exploitation, though they cannot undo server-side actions. Request-only WAF rules cannot always tell whether an exploit succeeded. Cloudflare now correlates requests with origin responses, adds managed response blocking and permits three custom response rules. - Status: Active - Published: 2026-10-22T06:16:16+13:00 - Updated: 2026-10-22T06:16:16+13:00 - Categories: Cloud & Infrastructure, Edge & CDN - Tags: Cloudflare, security - Canonical HTML: https://beyondthe.news/dossiers/cloudflare-waf-full-transaction-response-detection-rules-2026 ## What changed On October 21, 2026 Cloudflare launched full-transaction WAF detection and response-phase rules across all plans. The system correlates HTTP request and origin-response signals, allowing managed detections to identify evidence of successful exploitation and block the response before the requester receives it. All plans, including Free, can deploy managed protections and create up to three custom response rules with Log and Block actions. Initial managed signatures address PHP2Shell; richer detection fields are available to paying customers. ## Why it matters Traditional request-only WAF rules may flag a suspicious path but cannot determine whether an origin actually returned private data. Combining request and response evidence can reduce ambiguity, allow narrower protections and prevent some sensitive responses from reaching an attacker. However, it cannot reverse a command or database write already performed at the origin. It must complement rather than replace application and PHP security patches. ## Full transaction evidence Cloudflare evaluates suspicious request characteristics alongside response status, headers and detection signals. A traversal attempt followed by a response resembling a private configuration file is stronger evidence of exposure than the same request returning an error. Detections appear in Security Analytics and can feed managed response policies. ## Blocking after origin execution A response-phase rule can replace the origin response with an HTTP 403 WAF block page. That limits data reaching the requester but cannot undo an action already executed by the application. The first managed response signatures include PHP2Shell. ## Availability and limits Cloudflare says the managed response firewall and custom response rules are generally available for all plans, including Free. Customers can create up to three custom response rules with Log and Block actions. Custom response-body matching is not yet supported. Paid plans receive richer cf.waf.signature.response confidence, category and reference fields, with rollout ongoing. ## Deploy conservatively Review Security Analytics and Security Events, verify the managed response firewall ruleset, and start with narrow scopes and logging where legitimate traffic could be affected. Confirm that the PHP2Shell and other origin vulnerabilities are patched; a response-phase WAF is not a complete mitigation. ## What remains unverified Cloudflare's primary release describes capabilities and plan access, but there is no independent large-scale measurement of false positives or effectiveness. Initial detections focus on high-profile exploitation, and response-body custom rule matching remains unavailable. ## Key details - Announced October 21, 2026; general availability including Free. - Correlates incoming request with origin response. - Can replace a matching response with HTTP 403 before it reaches the requester. - Up to three custom response rules with Log and Block actions. - Custom response-body matching is not yet available. - Cannot undo origin-side actions already executed. ## Builder takeaways - Inspect new response detections in Cloudflare Security Analytics. - Scope response rules narrowly to reduce false positives. - Patch PHP2Shell and other origin vulnerabilities; do not rely solely on WAF blocking. - Understand paid-plan access to signature confidence fields. ## What to watch - More managed response detections. - Rollout of signature response fields and response-body custom matching. - Independent effectiveness and false-positive evidence. ## Uncertainties - Independent detection accuracy not yet established. - Some detection fields are still rolling out. - Coverage is initially focused on selected exploit patterns. ## Sources - [Introducing full transaction detection for Cloudflare WAF](https://blog.cloudflare.com/full-transaction-waf/) — Cloudflare · primary product announcement · 2026-10-21T00:00:00+13:00. GA, plan limits, response rules and constraints. - [Cloudflare deploys protections against php2shell vulnerability](https://blog.cloudflare.com/php-vulnerabilities-waf-protection/) — Cloudflare · primary security implementation · 2026-10-21T00:00:00+13:00. Initial managed detection context. - [Security advisory: Critical remote code execution vulnerabilities, update now](https://www.php.net/archive/2026.php#2026-10-21-1) — PHP Security Team · primary security advisory · 2026-10-21T00:00:00+13:00. CVEs, patch matrix, SAPIs, backports and partial mitigations.