#waf

2 articles tagged

Cloudflare WAF release card: five managed rules on 24 August 2026, default action 31 August, Pro log retention 24 hours

Engineering · Aug 24, 2026 · 12 min read

Cloudflare's 24 August 2026 WAF release ships 5 rules in Log mode - ruleset overrides make them Block

Cloudflare announced five WAF managed rules on 17 August 2026 for release on 24 August in Log mode. Its own override documentation contradicts that: ruleset and tag overrides apply to future rules.

Manu Shukla

#cloudflare #waf #web-security

Cloudflare leaked credentials detection now scans Authorization headers, 20 August 2026, on by default

Engineering · Aug 23, 2026 · 12 min read

Cloudflare began scanning Authorization headers on 20 August 2026, and the docs did not change

Cloudflare turned on Authorization header scanning for every zone with leaked credentials detection enabled, with no configuration change and no update to the page that documents it since 5 May 2026.

Manu Shukla

#cloudflare #waf #api-security