Cloudflare services for private origins is now generally available
Public traffic to private origins, with WAF, bot management, caching, and Workers, is now available to every customer with Cloudflare One connectivity.
TAG
Application Services
We tested our own WAF with frontier AI models. Here’s what we found
We built a WAF tester that adapted each request based on what the WAF blocked or passed. This helped us explore variations that a fixed test might miss. We ran it across six attack categories on an authorized staging environment and discovered detection gaps worth fixing. Here’s how the loop worked, what got through, and what we did about it.
Enforce positive security with Cloudflare Application Profiles
Cloudflare learns the structure of your HTTP requests and identifies deviations. You can add a positive security layer that helps reduce attack surface as AI makes it easier for attackers to generate and vary payloads.
Automatic Key Exchange: faster, post-quantum secure origin handshakes for 45 billion daily connections (and counting)
Automatic Key Exchange probes TLS 1.3-capable customer origins to learn which key agreement algorithms they support. We then lead with the most secure algorithm when connecting to the origin, preferring post-quantum connections wherever the origin supports it.
Introducing Cache Response Rules
Perhaps you’ve seen something that should sail out of cache get dragged back to the origin by a stray Set-Cookie or Cache-Control, headers that can be difficult to change on the origin itself. Cache Response Rules is the fix, applied at the right time.
Route public traffic to private applications with Cloudflare
Application Services for Private Origins is available now in closed beta. Route public hostnames to private IP origins over your existing IPsec, GRE, CNI, or Cloudflare Mesh paths. No public IPs or extra connector software required.
AI Security for Apps is now generally available
Cloudflare AI Security for Apps is now generally available, providing a security layer to discover and protect AI-powered applications, regardless of the model or hosting provider. We are also making AI discovery free for all plans, to help teams find and secure shadow AI deployments.
AI Security for Apps is now generally available
Cloudflare AI Security for Apps is now generally available, providing a security layer to discover and protect AI-powered applications, regardless of the model or hosting provider. We are also making AI discovery free for all plans, to help teams find and secure shadow AI deployments.
Active defense: introducing a stateful vulnerability scanner for APIs
Cloudflare’s new Web and API Vulnerability Scanner helps teams proactively find logic flaws. By using AI to build API call graphs, we identify vulnerabilities that standard defensive tools miss.
Shedding old code with ecdysis: graceful restarts for Rust services at Cloudflare
ecdysis is a Rust library enabling zero-downtime upgrades for network services. After five years protecting millions of connections at Cloudflare, it’s now open source.
Astro is joining Cloudflare
The Astro Technology Company team — the creators of the Astro web framework — is joining Cloudflare. We’re doubling down on making Astro the best framework for content-driven websites, today and in the years to come.
15 years of helping build a better Internet: a look back at Birthday Week 2025
Rust-powered core systems, post-quantum upgrades, developer access for students, PlanetScale integration, open-source partnerships, and our biggest internship program ever — 1,111 interns in 2026.
Securing data in SaaS to SaaS applications
The recent Salesloft breach taught us one thing: companies do not have visibility over data in SaaS applications. Cloudflare is committing to providing additional security tools for SaaS applications
The RUM Diaries: enabling Web Analytics by default
On October 15th 2025, Cloudflare is enabling Web Analytics for all free domains by default—helping you see how your site performs around the world in real time, without ever collecting personal data.
Banish bots from your Waiting Room and improve wait times for real users
Cloudflare Waiting Room is improving the user experience through the addition of Turnstile and Session Revocation, keeping wait times low and protecting against bot traffic.
Grinch Bots strike again: defending your holidays from cyber threats
Cloudflare observed a 4x increase in bot-related traffic on Black Friday in 2024. 29% of all traffic on our network on Black Friday was Grinch Bots wreaking holiday havoc.
Robotcop: enforcing your robots.txt policies and stopping bots before they reach your website
The AI Crawl Control (formerly AI Audit) now allows you to quickly see which AI services are honoring your robots.txt policies and then automatically enforce the policies against those that aren’t.
AI Everywhere with the WAF Rule Builder Assistant, Cloudflare Radar AI Insights, and updated AI bot protection
This year for Cloudflare’s birthday, we’ve extended our AI Assistant capabilities to help you build new WAF rules, added new AI bot & crawler traffic insights to Radar, and given customers new AI bot
