---
title: "A fully programmable secure web gateway"
description: "Traditional secure web gateways enforce security through a binary allow, block, or log model, which limits customization for complex environments. Cloudflare is integrating its Cloudflare Gateway and Data Loss Prevention with Cloudflare Workers, allowing customers to run arbitrary code inline at the moment a security decision is made. The new Forward action, available in public beta, routes matched HTTP traffic to a Worker that acts as inline middleware, enabling request and response modification or asynchronous tasks like sending Slack messages. Custom Functions, arriving before the end of the year, call a Worker during policy evaluation and return values used as selectors, enabling data-conditional rules and DLP validation against external APIs. Because Gateway and Workers run on the same machines in Cloudflare’s global network, dispatching traffic to a Worker is a local function call with no hairpinning or added latency."
---

# A fully programmable secure web gateway

[Cloudflare](https://yomu.fyi/company/cloudflare) · Abe Carryl · Oct 15, 2026

**Type:** Announcement

## Summary

Traditional secure web gateways enforce security through a binary allow, block, or log model, which limits customization for complex environments. Cloudflare is integrating its Cloudflare Gateway and Data Loss Prevention with Cloudflare Workers, allowing customers to run arbitrary code inline at the moment a security decision is made. The new Forward action, available in public beta, routes matched HTTP traffic to a Worker that acts as inline middleware, enabling request and response modification or asynchronous tasks like sending Slack messages. Custom Functions, arriving before the end of the year, call a Worker during policy evaluation and return values used as selectors, enabling data-conditional rules and DLP validation against external APIs. Because Gateway and Workers run on the same machines in Cloudflare’s global network, dispatching traffic to a Worker is a local function call with no hairpinning or added latency.

## Context

Security teams face a trade-off between maximum customization with high maintenance overhead or accepting vendor constraints with limited flexibility, as traditional secure web gateways only allow binary allow/block/log actions without inline programmability.

## Approach / What changed

Cloudflare integrates Gateway and DLP with Cloudflare Workers, introducing a Forward action that routes traffic to Workers as inline middleware, and Custom Functions that enable Workers to be called during policy evaluation to return values used as selectors. Both run on the same infrastructure, avoiding extra latency.

## Takeaways

- The Forward action allows a Worker to act as inline middleware, receiving full headers and request body, and can modify both request and response or perform asynchronous actions like sending Slack messages, while Gateway handles TCP, TLS, and certificate management.
- Custom Functions call a Worker during Gateway policy evaluation and return a value that is exposed as a selector in the policy builder, enabling data-conditional rules (e.g., user risk score) and DLP validation against external APIs.
- Because Cloudflare runs both Workers and Gateway on the same machines in its global network, dispatching traffic from Gateway to a Worker is a local function call with no hairpinning or added latency, unlike standalone SASE providers requiring separate automation and webhooks.

## FAQ

### What is the Forward action and what features does it provide?

The Forward action routes matched HTTP traffic to a Cloudflare Worker acting as inline middleware. The Worker can modify the request before forwarding to the origin, modify the response, or perform asynchronous actions such as sending Slack messages. Gateway handles TCP connections, TLS termination, and certificate management, so the Worker only handles transformation logic.

### How do Custom Functions enhance DLP validation?

Custom Functions allow a Worker to be called during DLP validation, receiving the DLP profile, payload, and matched excerpt. The Worker can return a score to accept or veto the match, enabling validation against external APIs, such as checking if a detected GitHub token is active by making an authenticated request and returning 'veto' if invalid.

### What is the latency advantage of Cloudflare's programmable gateway compared to other vendors?

Cloudflare runs both Workers and Gateway on the same machines in its global network, so dispatching traffic to a Worker is a local function call with no hairpinning or additional latency. Other SASE providers require separate automation and webhooks, which introduce round-trip latency and management overhead from stitching disconnected systems.

**Tags:** [Cloudflare Gateway](https://yomu.fyi/topic/cloudflare-gateway), [Cloudflare Workers](https://yomu.fyi/topic/cloudflare-workers), [Data Loss Prevention](https://yomu.fyi/topic/data-loss-prevention), [SASE](https://yomu.fyi/topic/sase), [Security](https://yomu.fyi/topic/security)

- Source: [Cloudflare](https://blog.cloudflare.com/programmable-gateway-dlp)
- Source URL: https://blog.cloudflare.com/programmable-gateway-dlp
- Ingested by Yomu: 2026-10-15T18:00:13.965Z

[Read original post](https://blog.cloudflare.com/programmable-gateway-dlp)