29 articles tagged
Cloudflare says post-quantum key exchange for Email Security is enabled automatically for all customers, but only pre-delivery MX/Inline deployment puts Cloudflare in the SMTP chain at all.
Cloudflare's dashboard now stores your email, login method and last-used profile in the browser, up to 5 per device. The login, SSO and account-security docs it links to never mention the feature.
Cloudflare announced dashboard editing for Cloudflare Tunnel origin parameters on 18 August 2026. Its reference doc is dated 7 May, omits a fourth category, and locks two proxy parameters to config files.
Cloudflare announced five WAF managed rules on 17 August 2026 for release on 24 August in Log mode. Its own override documentation contradicts that: ruleset and tag overrides apply to future rules.
Cloudflare API 403s now carry a documentation_url aimed at agents. Measured 23 August 2026 that URL is a 2,012,713-byte HTML page, and the .md route returns 404 site-wide.
Cloudflare Access resource lists now work for resource-scoped roles, but the roles page dated 10 August 2026 still calls the feature Beta, and reusable policies stay invisible without a second role.
Cloudflare Artifacts gained data localization on 13 August 2026 with two jurisdictions, eu and us. A repo pushed to an unknown namespace auto-creates that namespace, unrestricted and immutable.
The 20 August 2026 Browser Run changelog raised the Workers Paid concurrency default from 120 to 200 browsers. The pricing page, last updated 21 April 2026, still includes 10 at $2.00 each.
Cloudflare shipped CASB remediation policies on 21 August 2026. They revoke Microsoft 365 and Google Workspace file shares with no human in the loop, but CASB scans run every 24-48 hours.
Miniflare grants FUSE to local Containers only under a VM-backed or rootless Docker daemon. The official R2 example installs tigrisfs unpinned, and every ls on that mount bills as a Class A operation.
On 20 August 2026 Cloudflare added a Deployments tab to Durable Object namespaces and a second Traffic % number. The docs explaining the first were last updated 15 July 2026.
Cloudflare Gateway can now allow or block package downloads across seven ecosystems. Detection is fail-open, and an unparseable version string matches no comparison at all.
Cloudflare turned on Authorization header scanning for every zone with leaked credentials detection enabled, with no configuration change and no update to the page that documents it since 5 May 2026.
One build number, three risk profiles. Cloudflare shipped 2026.7.1343.0 to Windows, macOS and Linux on 19 August 2026. Only macOS lists no known issues; Windows has a downgrade trap and Linux a DNS leak.
Cloudflare turned on native soft-navigation measurement in Web Analytics on 21 August 2026. Two navigationType values arrive, pageview counts move, LCP needs Chrome 151, and CrUX reporting is undecided.
Cloudflare restored WebSocket data transfer accounting on 14 August 2026 but never dated the affected period. EdgeResponseBytes counts one direction; the websocket_analytics Logpush dataset counts four.
Cloudflare's 14 August 2026 changelog introduced an account-wide Access default for Workers. The docs page, updated 18 August, adds four limitations the announcement never mentions.
Cloudflare let developers decline optional OAuth scopes for Wrangler and its API MCP server on 22 August 2026. The wrangler login reference, dated 19 August, still says it takes every scope.
OpenAI dropped GPT-5.6 Sol list pricing 20% on input and 33% on output on 21 August 2026. Vercel rebased its 50% discount to $2/$10 the same day. Cloudflare's 19 August page still shows $2.50/$15.
R2 gained a third jurisdiction on 17 August 2026, guaranteeing US storage and processing. The docs updated on 19 August list one limitation. Four more sit in pages Cloudflare has not touched since April.
Cloudflare's Bot Preference Sync, announced 21 August 2026, writes robots.txt from your Search, Agent and Training settings. It is category-wide only and its documentation page returns a 404.
On 20 August 2026 Cloudflare let users deselect optional scopes at consent. RFC 6749 has permitted narrower grants since 2012, and most OAuth clients still assume the full requested set was approved.
Next.js 16.2's stable Adapter API and OpenNext let you run Next.js on AWS, Cloudflare, or Netlify instead of Vercel. The options, the caching that breaks at scale, and the 2026 cost math.
Cloudflare's Agents SDK, Durable Object Facets and Dynamic Workflows make per-agent isolation and near-zero idle cost practical in 2026. A build guide with a decision table versus AWS Bedrock AgentCore and Vercel.
Five AI gateways, three real cost levers, and one decision. This 2026 comparison of LiteLLM, Cloudflare AI Gateway, Kong, Bifrost and OpenRouter covers routing, semantic caching, budgets, and where each one should run
Cloudflare bought Astro in January 2026 and Astro 6 shipped in March. For content-heavy sites the choice against Next.js 16 comes down to JavaScript weight, hosting cost, and how much app logic you actually run.
The x402 protocol and Cloudflare's Monetization Gateway let APIs, SaaS and publishers charge AI agents per request in stablecoins. A 2026 guide to pricing models, setup, the HTTP 402 flow, and when to charge, block
From September 15, 2026 Cloudflare blocks Training and Agent crawlers by default on ad pages, and multi-purpose bots like Googlebot get caught in between. Here is how to set the three classes deliberately.
Precursor is Cloudflare's continuous, session-level bot detection for Enterprise Bot Management, live since July 13, 2026. Turnstile is the free challenge widget. This guide shows which to switch on, and when to run
