---
title: "Enforce positive security with Cloudflare Application Profiles"
description: "Cloudflare launches Application Profiles, a positive security feature that learns the expected structure of HTTP requests and identifies deviations. By analyzing path variables, query parameters, headers, cookies, and JSON body fields, the system builds a profile of valid data types, numeric ranges, string lengths, UUIDs, and enums. This approach reduces attack surface by blocking non-conforming requests without relying solely on known attack signatures, addressing the growing threat of AI-generated payloads. The feature extends Schema Learning and Schema Validation, previously available for APIs, to web applications. Profiles are automatically updated weekly as traffic changes. Customers can review violations in Security Analytics and create rules to enforce blocking, starting with observation mode; a closed beta is open to invited Enterprise customers without API Security."
---

# Enforce positive security with Cloudflare Application Profiles

[Cloudflare](https://yomu.fyi/company/cloudflare) · Zhiyuan Zheng · Sep 29, 2026

**Type:** Announcement

## Summary

Cloudflare launches Application Profiles, a positive security feature that learns the expected structure of HTTP requests and identifies deviations. By analyzing path variables, query parameters, headers, cookies, and JSON body fields, the system builds a profile of valid data types, numeric ranges, string lengths, UUIDs, and enums. This approach reduces attack surface by blocking non-conforming requests without relying solely on known attack signatures, addressing the growing threat of AI-generated payloads. The feature extends Schema Learning and Schema Validation, previously available for APIs, to web applications. Profiles are automatically updated weekly as traffic changes. Customers can review violations in Security Analytics and create rules to enforce blocking, starting with observation mode; a closed beta is open to invited Enterprise customers without API Security.

## Context

AI-generated attacks are increasing, making signature-based detection insufficient. Cloudflare introduces Application Profiles to learn expected request structure and enforce positive security, reducing attack surface without relying solely on known attack signatures.

## Approach / What changed

Cloudflare learns the expected structure of HTTP requests (paths, query parameters, headers, cookies, JSON body) by analyzing observed traffic. It builds a profile of valid data types, numeric ranges, string lengths, UUIDs, and enums. An always-on validation layer checks each request against the profile and adds metadata. Customers review violations in Security Analytics and create rules to block non-conforming requests. Profiles are updated weekly.

## Takeaways

- Application Profiles learn the expected structure of HTTP requests, including data types, numeric ranges, string lengths, UUIDs, and enums, and flag deviations without requiring a known attack signature.
- The feature is an extension of Schema Learning and Schema Validation, previously available for APIs, now applied to web applications. It supports paths, query parameters, headers, cookies, and JSON/form-encoded bodies, but not multipart forms, GraphQL, or XML.
- Cloudflare recommends starting in observation mode to review profile accuracy before enforcement, as non-conforming requests may be legitimate (e.g., application releases or new clients).

## FAQ

### How does Cloudflare learn the expected request structure?

Cloudflare's Schema Profiles analyze observed traffic for selected operations. They learn data types, numeric ranges, string lengths, UUIDs, and enums for path variables, query parameters, headers, cookies, and body fields. Learning requires at least 1,000 successful requests for fields and 10,000 for data boundaries, and profiles are updated weekly.

### What happens when a request does not conform to the learned profile?

The request is flagged as non-conforming, and metadata is added to the request. No action is taken automatically; customers can review violations in Security Analytics and create Security Rules to block non-conforming requests. Non-conforming does not always mean malicious, so observation mode is recommended.

### Is this feature available to all Cloudflare customers?

Application Profiles are available to customers with API Security. A closed beta is open to invited Enterprise customers without API Security. The feature supports paths, query parameters, headers, cookies, JSON bodies, and form-encoded bodies, but not multipart forms, GraphQL, or XML.

**Tags:** [Application Security](https://yomu.fyi/topic/application-security), [Cloudflare](https://yomu.fyi/topic/cloudflare), [WAF](https://yomu.fyi/topic/waf)

- Source: [Cloudflare](https://blog.cloudflare.com/application-profiles)
- Source URL: https://blog.cloudflare.com/application-profiles
- Ingested by Yomu: 2026-09-29T15:00:10.135Z

[Read original post](https://blog.cloudflare.com/application-profiles)