Modify incoming requests, change Cloudflare settings, or trigger actions
Core platform•Official page ↗
Failed detections field available in Rules
You can now use cf.appsec.request.failed_detections to control how your rules handle requests when a security detection reports a failure.
hash_in_range() is globally available for HTTP products
on all plans. It hashes fields into an integer within a specified range. Use this result to select a portion of requests.
Handle missing values with coalesce()
The coalesce() function returns the first argument that is not nil. Use it to provide a fallback in rule expressions:
Compare dynamic values in Rules expressions
Cloudflare Rules expressions now support dynamic values on both sides of equality and ordering comparisons. You can compare request fields or function results with one another.
concat() now supports up to 32 arguments
The concat() function in Cloudflare Rules now accepts up to 32 arguments, increased from 16. This allows you to build richer dynamic values directly in Rules expressions and simplify configurations that combine request data.
Validate Rulesets changes before deployment
Cloudflare Rules now validates ruleset changes before deployment, helping you catch invalid expressions, action parameters, permission issues, unavailable features, and quota limits without publishing the configuration.
Oracle Cloud Infrastructure Object Storage support in Cloud Connector
Cloud Connector now supports public Oracle Cloud Infrastructure (OCI) Object Storage buckets. You can route matching requests to OCI without managing a separate origin-routing configuration.
Bot management fields and ASN support in Cache Rules
h4
New QUIC RTT and delivery rate fields
Two new fields are now available in rule expressions that surface Layer 4 transport telemetry from the client connection.
New mTLS certificate fields for Transform Rules
Cloudflare now exposes four new fields in the Transform Rules phase that encode client certificate data in RFC 9440 format. Previously, forwarding client certificate information to your origin required custom parsing of PEM-encoded fields or non-standard HTTP header formats.
Worker execution timing field now available in Rules
The cf.timings.worker_msec field is now available in the Ruleset Engine. This field reports the wall-clock time that a Cloudflare Worker spent handling a request, measured in milliseconds.
Control request and response body buffering in Configuration Rules
You can now control how Cloudflare buffers HTTP request and response bodies using two new settings in Configuration Rules.
New cryptographic functions — encode_base64() and sha256()
Cloudflare Rulesets now includes encode_base64() and sha256() functions, enabling you to generate signed request headers directly in rule expressions.
New functions for array and map operations
Metro code field now available in Rules
The ip.src.metro_code field in the Ruleset Engine is now populated with DMA (Designated Market Area) data.
