---
title: "Introducing full transaction detection for Cloudflare WAF"
description: "Cloudflare has expanded its web application firewall with full transaction detection and response rules, correlating each HTTP request with its response to identify evidence of successful exploitation. This approach answers both whether a request looks malicious and what happened when the application handled it, using new fields like cf.waf.signature.response.confidence. For example, a path traversal attempt followed by a response containing configuration file content provides stronger evidence of data exposure than either signal alone. Response rules can block the origin’s response before it reaches the requester, preventing sensitive information from reaching an attacker. The feature is generally available to all Cloudflare customers, including Free plans, with managed protections for high-profile vulnerabilities such as php2shell. Detection and mitigation are separated, allowing security teams to inspect detections in Security Analytics before designing policies."
---

# Introducing full transaction detection for Cloudflare WAF

[Cloudflare](https://yomu.fyi/company/cloudflare) · Nick Downie · Oct 21, 2026

**Type:** Announcement

## Summary

Cloudflare has expanded its web application firewall with full transaction detection and response rules, correlating each HTTP request with its response to identify evidence of successful exploitation. This approach answers both whether a request looks malicious and what happened when the application handled it, using new fields like cf.waf.signature.response.confidence. For example, a path traversal attempt followed by a response containing configuration file content provides stronger evidence of data exposure than either signal alone. Response rules can block the origin’s response before it reaches the requester, preventing sensitive information from reaching an attacker. The feature is generally available to all Cloudflare customers, including Free plans, with managed protections for high-profile vulnerabilities such as php2shell. Detection and mitigation are separated, allowing security teams to inspect detections in Security Analytics before designing policies.

## Context

Cloudflare WAF previously only inspected HTTP requests to block attacks. This left a gap: a suspicious request followed by a response exposing sensitive data is different from the same request followed by an error. The new full transaction detection correlates request and response to confirm exploitation, and response rules block the origin response before it reaches the requester.

## Approach / What changed

Cloudflare added new detection fields (cf.waf.signature.response.confidence, categories, ref) that are populated by analyzing the response alongside the request. Response custom rules can then use these fields to block matching responses. Managed protections are provided for high-profile vulnerabilities like php2shell. Detection and mitigation are separated: detections are visible in Security Analytics, and rules can be configured independently.

## Takeaways

- Full transaction detection correlates request and response to confirm successful exploitation, reducing false positives compared to request-only inspection.
- Response rules can block the origin’s response before it reaches the requester, preventing data exposure from exploits like path traversal.
- The feature is available to all Cloudflare customers including Free plans, with managed protections for high-profile vulnerabilities.

## FAQ

### How does full transaction detection differ from request-only WAF?

Full transaction detection correlates the request with the response to confirm whether an exploit succeeded, using response content as evidence. Request-only inspection can only flag suspicious inputs, but cannot tell if the exploit actually worked or exposed data.

### What is the php2shell vulnerability?

The php2shell vulnerability is a flaw in a common software component that puts applications across the Internet at risk. Cloudflare's first managed protections using full transaction detection address this vulnerability.

### Can I create custom response rules?

Yes, paying customers can use detection fields like cf.waf.signature.response.confidence in custom response rules to block responses based on request and response properties. Free plan customers get managed protections for high-profile vulnerabilities.

**Tags:** [Cloudflare](https://yomu.fyi/topic/cloudflare), [Managed Rules](https://yomu.fyi/topic/managed-rules), [Security](https://yomu.fyi/topic/security), [Vulnerabilities](https://yomu.fyi/topic/vulnerabilities), [WAF](https://yomu.fyi/topic/waf)

- Source: [Cloudflare](https://blog.cloudflare.com/full-transaction-waf)
- Source URL: https://blog.cloudflare.com/full-transaction-waf
- Ingested by Yomu: 2026-10-21T15:00:23.221Z

[Read original post](https://blog.cloudflare.com/full-transaction-waf)