Cloudflare’s firewall now checks the answer, too. A blocked response is not a repaired server
Full-transaction detection adds outgoing evidence to incoming requests. The distinction matters when an attack has already changed application state.
Cloudflare’s firewall can now examine what a website sends back, alongside what a visitor asked for. Its October 21 announcement makes full-transaction detection available for sites proxying traffic through Cloudflare, including the Free plan. The important limit is physical: blocking an outgoing response can prevent information escaping, but cannot reverse work the application has already performed.
That makes the feature a useful extra boundary for site operators, rather than evidence that a vulnerable application has been repaired. A rejected download and an unchanged database are two different outcomes.
The answer supplies missing evidence
A web application firewall, or WAF, sits in the path of web traffic and applies security rules. Looking at an incoming request can reveal suspicious intent. Looking at the corresponding answer helps establish whether the application produced something it should not have exposed.
The distinction matters when interpreting an alert. An unsuccessful probe can resemble the first half of a successful attack. Conversely, a harmless page can contain technical text that looks alarming outside its context. Joining both sides gives a rule more evidence to work with; it does not make every match a conclusive diagnosis.
Cloudflare’s launch explanation separates detection from enforcement. A response rule can replace a matching answer with a blocking page. The company also provides managed response protection and custom rules, with access to particular fields depending on the plan. Availability is therefore a reason to inspect the configuration, not to assume every desired policy is already active.
An alert still needs a policy
The underlying Attack Signature Detection documentation describes matching metadata separately from the action taken on it. Confidence, category and signature identifiers let operators examine patterns and scope a rule. Detection alone is not synonymous with blocking.
For a small team, that separation is useful because a security change can also disrupt legitimate work. A file-export endpoint and a public documentation page may deserve different treatment. Reviewing a match in its application context helps avoid answering a false positive with an exception so broad that the protection loses its purpose.
This is an operational tradeoff, not a measured claim that the new system eliminates false positives. Cloudflare’s announcement establishes the capability; it does not provide an independent assessment of detection quality across every application.
Keep the patch in the plan
OWASP’s guidance on virtual patching distinguishes a protective policy outside an application from correcting the vulnerable code. The former can reduce exposure while the latter is prepared. A WAF rule should not make the underlying defect disappear from the maintenance list.
Imagine a response is successfully withheld after an application has changed an account setting. The visitor may see an error, yet the stored change still exists. That example illustrates why the result visible in a browser cannot establish the state of the origin server. Logs, application state and the vulnerability’s actual behavior remain relevant.
For readers following Cloudflare, the new control closes a useful gap between inspecting an attempt and seeing its immediate output. Its strongest contribution is another chance to interrupt harm. The website owner still has to fix the reason the dangerous answer could be produced.
