Cloudflare WAF can inspect a request together with its response

Cloudflare’s web application firewall can now combine a suspicious HTTP request with evidence in the origin’s response. A traversal attempt followed by configuration-file content provides a stronger signal than either alone. Response rules can replace a matching response with a block page before it reaches the requester. This can prevent information disclosure, but cannot undo changes or other actions the application has already performed.

Cloudflare Blog · Oct 21, 2026

Why it matters

The outcome of a request can reveal an exploit that an input-only rule cannot confidently identify.

More context

The release is generally available for proxied zones, including Free plans. Customers can create up to three custom response rules with Log or Block actions. Try a narrowly scoped logging rule and inspect Security Events before blocking. Detection fields and available rule fields depend on plan and rollout.

Keep in mind

Custom rules cannot yet match response bodies directly. Managed detections may use content signals, while custom policies use exposed fields; false positives still require application-specific review.

Original read