Rules

Remove surrounding bytes with trim functions

Cloudflare Rules supports three new functions for removing surrounding bytes. Use them to remove whitespace before comparing request values. All HTTP products support these functions on all plans: trim() removes bytes from both ends. trim_start() removes bytes from the start. trim_end() removes bytes from the end. By default, these functions remove ASCII whitespace. An optional constant string sp…

Failed detections field available in Rules

You can now use cf.appsec.request.failed_detections to control how your rules handle requests when a security detection reports a failure. The field is an Array<String> of detection IDs that reports failures from content scanning, WAF attack score, attack signature detection, leaked credentials detection, and AI prompt detections for personally identifiable information (PII), prompt injection, cu…

hash_in_range() is globally available for HTTP products

hash_in_range() is globally available for HTTP products on all plans. It hashes fields into an integer within a specified range. Use this result to select a portion of requests. Use cf.random_seed to select approximately 10% of requests at random: hash_in_range(0, 100, cf.random_seed) < 10 With Cloudflare for SaaS, use custom metadata to control rollout progression. Define rollout_pct as a custom…

Handle missing values with coalesce()

The coalesce() function returns the first argument that is not nil. Use it to provide a fallback in rule expressions: http.request.uri.path eq coalesce(http.request.uri.args["expected_path"][0], "/") For details, refer to the coalesce() function reference.

Compare dynamic values in Rules expressions

Cloudflare Rules expressions now support dynamic values on both sides of equality and ordering comparisons. You can compare request fields or function results with one another. For example, compare the current request path with its original value: http.request.uri.path ne raw.http.request.uri.path For supported operators and examples, refer to Compare dynamic values.

Longer rule descriptions in logs

Cloudflare logs now include up to 128 bytes of a rule description, increased from 80 bytes. Longer descriptions provide more context when investigating matched rules and make it easier to identify the relevant rule without referring back to its configuration. Descriptions longer than 128 bytes are truncated without splitting a UTF-8 character. This change does not affect the Rulesets API, which c…

concat() now supports up to 32 arguments

The concat() function in Cloudflare Rules now accepts up to 32 arguments, increased from 16. This allows you to build richer dynamic values directly in Rules expressions and simplify configurations that combine request data. A common use case is adding a request header that sends context to your origin. The following Rulesets API request adds a Request Header Transform Rule to an existing http_re…

Validate Rulesets changes before deployment

Cloudflare Rules now validates ruleset changes before deployment, helping you catch invalid expressions, action parameters, permission issues, unavailable features, and quota limits without publishing the configuration. The Cloudflare dashboard performs this validation automatically when you create or update rules from Security > Security rules or Rules > Overview. Supported Rulesets API mutation…

Oracle Cloud Infrastructure Object Storage support in Cloud Connector

Cloud Connector now supports public Oracle Cloud Infrastructure (OCI) Object Storage buckets. You can route matching requests to OCI without managing a separate origin-routing configuration. OCI support uses the Amazon S3 Compatibility API. Both path-style and virtual-hosted endpoint formats are supported, including traditional oraclecloud.com and dedicated customer-oci.com path-style endpoints.…

Bot management fields and ASN support in Cache Rules

Bot management fields and ASN support in Cache Rules Cache Rules now supports bot management fields and the ip.src.asnum field in expression filters. You can now build cache policies that differentiate between automated and human traffic, or segment caching behavior by autonomous system number (ASN). This allows you to apply different caching strategies for verified bots, high-risk traffic, or sp…

New QUIC RTT and delivery rate fields

Two new fields are now available in rule expressions that surface Layer 4 transport telemetry from the client connection. Together with the existing cf.timings.client_tcp_rtt_msec field, these fields give you a complete picture of connection quality for both TCP and QUIC traffic — enabling transport-aware rules without requiring any client-side changes. Previously, QUIC RTT and delivery rate data…

New mTLS certificate fields for Transform Rules

Cloudflare now exposes four new fields in the Transform Rules phase that encode client certificate data in RFC 9440 ↗︎ format. Previously, forwarding client certificate information to your origin required custom parsing of PEM-encoded fields or non-standard HTTP header formats. These new fields produce output in the standardized Client-Cert and Client-Cert-Chain header format defined by RFC 9440,…

Worker execution timing field now available in Rules

The cf.timings.worker_msec field is now available in the Ruleset Engine. This field reports the wall-clock time that a Cloudflare Worker spent handling a request, measured in milliseconds. You can use this field to identify slow Worker executions, detect performance regressions, or build rules that respond differently based on Worker processing time, such as logging requests that exceed a latency…

Control request and response body buffering in Configuration Rules

You can now control how Cloudflare buffers HTTP request and response bodies using two new settings in Configuration Rules. Request body buffering Controls how Cloudflare buffers HTTP request bodies before forwarding them to your origin server: Mode Behavior Standard (default) Cloudflare can inspect a prefix of the request body for enabled functionality such as WAF and Bot Management. Full Buffers…

New cryptographic functions — encode_base64() and sha256()

Cloudflare Rulesets now includes encode_base64() and sha256() functions, enabling you to generate signed request headers directly in rule expressions. These functions support common patterns like constructing a canonical string from request attributes, computing a SHA256 digest, and Base64-encoding the result. New functions Function Description Availability encode_base64(input, flags) Encodes a s…

New functions for array and map operations

New functions for array and map operations Cloudflare Rulesets now include new functions that enable advanced expression logic for evaluating arrays and maps. These functions allow you to build rules that match against lists of values in request or response headers, enabling use cases like country-based blocking using custom headers. New functions Function Description split(source, delimiter) Spl…

Metro code field now available in Rules

The ip.src.metro_code field in the Ruleset Engine is now populated with DMA (Designated Market Area) data. You can use this field to build rules that target traffic based on geographic market areas, enabling more granular location-based policies for your applications. Field details Field Type Description ip.src.metro_code String | null The metro code (DMA) of the incoming request's IP address. Re…

New TCP-based fields available in Rulesets

Build rules based on TCP transport and latency Cloudflare now provides two new request fields in the Ruleset engine that let you make decisions based on whether a request used TCP and the measured TCP round-trip time between the client and Cloudflare. These fields help you understand protocol usage across your traffic and build policies that respond to network performance. For example, you can di…

More flexible fallback handling — Custom Errors now support fetching assets returned with 4xx or 5xx status codes

Custom Errors can now fetch and store assets and error pages from your origin even if they are served with a 4xx or 5xx HTTP status code — previously, only 200 OK responses were allowed. What’s new: You can now upload error pages and error assets that return error status codes (for example, 403, 500, 502, 503, 504) when fetched. These assets are stored and minified at the edge, so they can be reu…

Match Workers subrequests by upstream zone — cf.worker.upstream_zone now supported in Transform Rules

You can now use the cf.worker.upstream_zone field in Transform Rules to control rule execution based on whether a request originates from Workers, including subrequests issued by Workers in other zones. What's new: cf.worker.upstream_zone is now supported in Transform Rules expressions. Skip or apply logic conditionally when handling Workers subrequests. For example, to add a header when the subr…

Fine-tune image optimization — WebP now supported in Configuration Rules

You can now enable Polish with the webp format directly in Configuration Rules, allowing you to optimize image delivery for specific routes, user agents, or A/B tests — without applying changes zone-wide. What’s new: WebP is now a supported value in the Polish setting for Configuration Rules. This gives you more precise control over how images are compressed and delivered, whether you're targetin…

More ways to match — Snippets now support Custom Lists, Bot Score, and WAF Attack Score

You can now use IP, Autonomous System (AS), and Hostname custom lists to route traffic to Snippets and Cloud Connector, giving you greater precision and control over how you match and process requests at the edge. In Snippets, you can now also match on Bot Score and WAF Attack Score, unlocking smarter edge logic for everything from request filtering and mitigation to tarpitting and logging. What’…

Custom Errors are now Generally Available

Custom Errors are now generally available for all paid plans — bringing a unified and powerful experience for customizing error responses at both the zone and account levels. You can now manage Custom Error Rules, Custom Error Assets, and redesigned Error Pages directly from the Cloudflare dashboard. These features let you deliver tailored messaging when errors occur, helping you maintain brand c…

Cloudflare Snippets are now Generally Available

Cloudflare Snippets are now generally available at no extra cost across all paid plans — giving you a fast, flexible way to programmatically control HTTP traffic using lightweight JavaScript. You can now use Snippets to modify HTTP requests and responses with confidence, reliability, and scale. Snippets are production-ready and deeply integrated with Cloudflare Rules, making them ideal for everyt…

Increased Cloudflare Rules limits

We have upgraded and streamlined Cloudflare Rules limits across all plans, simplifying rule management and improving scalability for everyone. New limits by product: Bulk Redirects Free: 20 → 10,000 URL redirects across lists Pro: 500 → 25,000 URL redirects across lists Business: 500 → 50,000 URL redirects across lists Enterprise: 10,000 → 1,000,000 URL redirects across lists Cloud Connector Free…

Custom Errors (beta): Stored Assets & Account-level Rules

We're introducing Custom Errors (beta), which builds on our existing Custom Error Responses feature with new asset storage capabilities. This update allows you to store externally hosted error pages on Cloudflare and reference them in custom error rules, eliminating the need to supply inline content. This brings the following new capabilities: Custom error assets – Fetch and store external error…

New Snippets Code Editor

The new Snippets code editor lets you edit Snippet code and rule in one place, making it easier to test and deploy changes without switching between pages. What’s new: Single-page editing for code and rule – No need to jump between screens. Auto-complete & syntax highlighting – Get suggestions and avoid mistakes. Code formatting & refactoring – Write cleaner, more readable code. Try it now in Rul…

New Rules Overview Interface

Rules Overview gives you a single page to manage all your Cloudflare Rules. What you can do: See all your rules in one place – No more clicking around. Find rules faster – Search by name. Understand execution order – See how rules run in sequence. Debug easily – Use Rules simulator without switching tabs. Check it out in Rules > Overview ↗︎.

Terraform Support for Snippets

Now, you can manage Cloudflare Snippets with Terraform. Use infrastructure-as-code to deploy and update Snippet code and rules without manual changes in the dashboard. Example Terraform configuration: resource "cloudflare_snippet" "my_snippet" { zone_id = "<ZONE_ID>" name = "my_test_snippet_1" main_module = "file1.js" files { name = "file1.js" content = file("file1.js") } } resource "cloudflare_s…

Cloud Connector Now Supports R2

Now, you can use Cloud Connector to route traffic to your R2 buckets based on URLs, headers, geolocation, and more. Example setup: curl --request PUT \ "https://api.cloudflare.com/client/v4/zones/{zone_id}/cloud_connector/rules" \ --header "Authorization: Bearer <API_TOKEN>" \ --header "Content-Type: application/json" \ --data '[ { "expression": "http.request.uri.path wildcard \"/images/*\"", "pr…

Simplified UI for URL Rewrites

It’s now easy to create wildcard-based URL Rewrites. No need for complex functions—just define your patterns and go. What’s improved: Full wildcard support – Create rewrite patterns using intuitive interface. Simplified rule creation – No need for complex functions. Try it via creating a Rewrite URL rule in the dashboard.

New Rules Templates for One-Click Rule Creation

Now, you can create common rule configurations in just one click using Rules Templates. What you can do: Pick a pre-built rule – Choose from a library of templates. One-click setup – Deploy best practices instantly. Customize as needed – Adjust templates to fit your setup. Template cards are now also available directly in the rule builder for each product. Need more ideas? Check out the Examples…