Changelog

After you triage your users' submissions (that are machine reviewed), you can now escalate them to our team for reclassification (which are instead human reviewed). User submissions from the submission alias, PhishNet, and our API can all be escalated.

From Reclassifications, go to User submissions. Select the three dots next to any of the user submissions, then select Escalate to create a team request for reclassification. The Cloudflare dashboard will then show you the submissions on the Team Submissions tab.

Refer to User submissions to learn more about this feature.

This feature is available across these Email security packages:

• Advantage
• Enterprise
• Enterprise + PhishGuard

You now have more transparency about team and user submissions for phishing emails through a Reclassification tab in the Zero Trust dashboard.

Reclassifications happen when users or admins submit a phish to Email security. Cloudflare reviews and - in some cases - reclassifies these emails based on improvements to our machine learning models.

This new tab increases your visibility into this process, allowing you to view what submissions you have made and what the outcomes of those submissions are.

The latest cloudflared build 2024.12.2 ↗ introduces the ability to collect all the diagnostic logs needed to troubleshoot a cloudflared instance.

A diagnostic report collects data from a single instance of cloudflared running on the local machine and outputs it to a cloudflared-diag file.

For more information, refer to Diagnostic logs.

Magic WAN and Magic Transit customers can use the Cloudflare dashboard to configure and manage BGP peering between their networks and their Magic routing table when using a Direct CNI on-ramp.

Using BGP peering allows customers to:

• Automate the process of adding or removing networks and subnets.
• Take advantage of failure detection and session recovery features.

With this functionality, customers can:

• Establish an eBGP session between their devices and the Magic WAN / Magic Transit service when connected via CNI.
• Secure the session by MD5 authentication to prevent misconfigurations.
• Exchange routes dynamically between their devices and their Magic routing table.

Refer to Magic WAN BGP peering or Magic Transit BGP peering to learn more about this feature and how to set it up.

Hyperdrive now caches queries in all Cloudflare locations, decreasing cache hit latency by up to 90%.

When you make a query to your database and Hyperdrive has cached the query results, Hyperdrive will now return the results from the nearest cache. By caching data closer to your users, the latency for cache hits reduces by up to 90%.

This reduction in cache hit latency is reflected in a reduction of the session duration for all queries (cached and uncached) from Cloudflare Workers to Hyperdrive, as illustrated below.

P50, P75, and P90 Hyperdrive session latency for all client connection sessions (both cached and uncached queries) for Hyperdrive configurations with caching enabled during the rollout period.

This performance improvement is applied to all new and existing Hyperdrive configurations that have caching enabled.

For more details on how Hyperdrive performs query caching, refer to the Hyperdrive documentation.

Now, you can manage Cloudflare Snippets with Terraform. Use infrastructure-as-code to deploy and update Snippet code and rules without manual changes in the dashboard.

Example Terraform configuration:

resource "cloudflare_snippet" "my_snippet" {
	zone_id  = "<ZONE_ID>"
	name = "my_test_snippet_1"
	main_module = "file1.js"
	files {
		name = "file1.js"
		content = file("file1.js")
	}
}

resource "cloudflare_snippet_rules" "cookie_snippet_rule" {
	zone_id  = "<ZONE_ID>"
	rules {
		enabled = true
		expression = "http.cookie eq \"a=b\""
		description = "Trigger snippet on specific cookie"
		snippet_name = "my_test_snippet_1"
	}
	depends_on = [cloudflare_snippet.my_snippet]
}

Learn more in the Configure Snippets using Terraform documentation.

You can now generate customized terraform files for building cloud network on-ramps to Magic WAN.

Magic Cloud can scan and discover existing network resources and generate the required terraform files to automate cloud resource deployment using their existing infrastructure-as-code workflows for cloud automation.

You might want to do this to:

• Review the proposed configuration for an on-ramp before deploying it with Cloudflare.
• Deploy the on-ramp using your own infrastructure-as-code pipeline instead of deploying it with Cloudflare.

For more details, refer to Set up with Terraform.

You can now use CASB to find security misconfigurations in your AWS cloud environment using Data Loss Prevention.

You can also connect your AWS compute account to extract and scan your S3 buckets for sensitive data while avoiding egress fees. CASB will scan any objects that exist in the bucket at the time of configuration.

To connect a compute account to your AWS integration:

1. In Cloudflare One ↗, go to Cloud & SaaS findings > Integrations.
2. Find and select your AWS integration.
3. Select Open connection instructions.
4. Follow the instructions provided to connect a new compute account.
5. Select Refresh.

Now, you can use Cloud Connector to route traffic to your R2 buckets based on URLs, headers, geolocation, and more.

Example setup:

curl --request PUT \
"https://api.cloudflare.com/client/v4/zones/{zone_id}/cloud_connector/rules" \
--header "Authorization: Bearer <API_TOKEN>" \
--header "Content-Type: application/json" \
--data '[
  {
    "expression": "http.request.uri.path wildcard \"/images/*\"",
    "provider": "cloudflare_r2",
    "description": "Connect to R2 bucket containing images",
    "parameters": {
      "host": "mybucketcustomdomain.example.com"
    }
  }
]'

Get started using Cloud Connector documentation.

You can now type in languages that use diacritics (like á or ç) and character-based scripts (such as Chinese, Japanese, and Korean) directly within the remote browser. The isolated browser now properly recognizes non-English keyboard input, eliminating the need to copy and paste content from a local browser or device.

You can now reduce latency and lower R2 egress costs automatically when using Smart Tiered Cache with R2. Cloudflare intelligently selects a tiered data center close to your R2 bucket location, creating an efficient caching topology without additional configuration.

When you enable Smart Tiered Cache for zones using R2 as an origin, Cloudflare automatically:

1. Identifies your R2 bucket location: Determines the geographical region where your R2 bucket is stored.
2. Selects an optimal Upper Tier: Chooses a data center close to your bucket as the common Upper Tier cache.
3. Routes requests efficiently: All cache misses in edge locations route through this Upper Tier before reaching R2.

• Automatic optimization: No manual configuration required.
• Lower egress costs: Fewer requests to R2 reduce egress charges.
• Improved hit ratio: Common Upper Tier increases cache efficiency.
• Reduced latency: Upper Tier proximity to R2 minimizes fetch times.

To get started, enable Smart Tiered Cache on your zone using R2 as an origin.

You can now use the cache property of the Request interface to bypass Cloudflare's cache when making subrequests from Cloudflare Workers, by setting its value to no-store.

export default {
	async fetch(req, env, ctx) {
		const request = new Request("https://cloudflare.com", {
			cache: "no-store",
		});
		const response = await fetch(request);
		return response;
	},
};

export default {
  async fetch(req, env, ctx): Promise<Response> {
		const request = new Request("https://cloudflare.com", { cache: 'no-store'});
		const response = await fetch(request);
    return response;
  }
} satisfies ExportedHandler<Environment>

When you set the value to no-store on a subrequest made from a Worker, the Cloudflare Workers runtime will not check whether a match exists in the cache, and not add the response to the cache, even if the response includes directives in the Cache-Control HTTP header that otherwise indicate that the response is cacheable.

This increases compatibility with NPM packages and JavaScript frameworks that rely on setting the cache property, which is a cross-platform standard part of the Request interface. Previously, if you set the cache property on Request, the Workers runtime threw an exception.

If you've tried to use @planetscale/database, redis-js, stytch-node, supabase, axiom-js or have seen the error message The cache field on RequestInitializerDict is not implemented in fetch — you should try again, making sure that the Compatibility Date of your Worker is set to on or after 2024-11-11, or the cache_option_enabled compatibility flag is enabled for your Worker.

• Learn how the Cache works with Cloudflare Workers
• Enable Node.js compatibility for your Cloudflare Worker
• Explore Runtime APIs and Bindings available in Cloudflare Workers

You can now send user action logs for Email security to an endpoint of your choice with Cloudflare Logpush.

Filter logs matching specific criteria you have set or select from multiple fields you want to send. For all users, we will log the date and time, user ID, IP address, details about the message they accessed, and what actions they took.

When creating a new Logpush job, remember to select Audit logs as the dataset and filter by:

• Field: "ResourceType"
• Operator: "starts with"
• Value: "email_security".

For more information, refer to Enable user action logs.

This feature is available across all Email security packages:

• Enterprise
• Enterprise + PhishGuard

You can now stage and test cache configurations before deploying them to production. Versioned environments let you safely validate cache rules, purge operations, and configuration changes without affecting live traffic.

With versioned environments, you can:

1. Create staging versions of your cache configuration.
2. Test cache rules in a non-production environment.
3. Purge staged content independently from production.
4. Validate changes before promoting to production.

This capability integrates with Cloudflare's broader versioning system, allowing you to manage cache configurations alongside other zone settings.

• Risk-free testing: Validate configuration changes without impacting production.
• Independent purging: Clear staging cache without affecting live content.
• Deployment confidence: Catch issues before they reach end users.
• Team collaboration: Multiple team members can work on different versions.

To get started, refer to the version management documentation.

Enterprise customers can now optimize cache hit ratios for content that varies by device, language, or referrer by sharding cache using up to ten values from previously restricted headers with custom cache keys.

When configuring custom cache keys, you can now include values from these headers to create distinct cache entries:

• accept* headers (for example, accept, accept-encoding, accept-language): Serve different cached versions based on content negotiation.
• referer header: Cache content differently based on the referring page or site.
• user-agent header: Maintain separate caches for different browsers, devices, or bots.

• Content varies significantly by device type (mobile vs desktop).
• Different language or encoding preferences require distinct responses.
• Referrer-specific content optimization is needed.

{
  "cache_key": {
    "custom_key": {
      "header": {
        "include": ["accept-language", "user-agent"],
        "check_presence": ["referer"]
      }
    }
  }
}

This configuration creates separate cache entries based on the accept-language and user-agent headers, while also considering whether the referer header is present.

To get started, refer to the custom cache keys documentation.

Workflows is now in open beta, and available to any developer a free or paid Workers plan.

Workflows allow you to build multi-step applications that can automatically retry, persist state and run for minutes, hours, days, or weeks. Workflows introduces a programming model that makes it easier to build reliable, long-running tasks, observe as they progress, and programmatically trigger instances based on events across your services.

You can get started with Workflows by following our get started guide and/or using npm create cloudflare to pull down the starter project:

npm create cloudflare@latest workflows-starter -- --template "cloudflare/workflows-starter"

You can open the src/index.ts file, extend it, and use wrangler deploy to deploy your first Workflow. From there, you can:

• Learn the Workflows API
• Trigger Workflows via your Workers apps.
• Understand the Rules of Workflows and how to adopt best practices

It’s now easy to create wildcard-based URL Rewrites. No need for complex functions—just define your patterns and go.

What’s improved:

• Full wildcard support – Create rewrite patterns using intuitive interface.
• Simplified rule creation – No need for complex functions.

Try it via creating a Rewrite URL rule in the dashboard.

Cloudflare has introduced new fields to two Gateway-related datasets in Cloudflare Logs:

• Gateway HTTP: ApplicationIDs, ApplicationNames, CategoryIDs, CategoryNames, DestinationIPContinentCode, DestinationIPCountryCode, ProxyEndpoint, SourceIPContinentCode, SourceIPCountryCode, VirtualNetworkID, and VirtualNetworkName.

• Gateway Network: ApplicationIDs, ApplicationNames, DestinationIPContinentCode, DestinationIPCountryCode, ProxyEndpoint, SourceIPContinentCode, SourceIPCountryCode, TransportProtocol, VirtualNetworkID, and VirtualNetworkName.

The Magic Firewall dashboard now allows you to search custom rules using the rule name and/or ID.

1. Log into the Cloudflare dashboard ↗ and select your account.
2. Go to Analytics & Logs > Network Analytics.
3. Select Magic Firewall.
4. Add a filter for Rule ID.

Additionally, the rule ID URL link has been added to Network Analytics.

Organizations can now eliminate long-lived credentials from their SSH setup and enable strong multi-factor authentication for SSH access, similar to other Access applications, all while generating access and command logs.

SSH with Access for Infrastructure uses short-lived SSH certificates from Cloudflare, eliminating SSH key management and reducing the security risks associated with lost or stolen keys. It also leverages a common deployment model for Cloudflare One customers: WARP-to-Tunnel.

SSH with Access for Infrastructure enables you to:

• Author fine-grained policy to control who may access your SSH servers, including specific ports, protocols, and SSH users.
• Monitor infrastructure access with Access and SSH command logs, supporting regulatory compliance and providing visibility in case of security breach.
• Preserve your end users' workflows. SSH with Access for Infrastructure supports native SSH clients and does not require any modifications to users’ SSH configs.

To get started, refer to SSH with Access for Infrastructure.

The free version of Magic Network Monitoring (MNM) is now available to everyone with a Cloudflare account by default.

1. Log in to your Cloudflare dashboard ↗, and select your account.
2. Go to Analytics & Logs > Magic Monitoring.

For more details, refer to the Get started guide.

Every site on Cloudflare now has access to AI Audit, which summarizes the crawling behavior of popular and known AI services.

You can use this data to:

• Understand how and how often crawlers access your site (and which content is the most popular).
• Block specific AI bots accessing your site.
• Use Cloudflare to enforce your robots.txt policy via an automatic WAF rule.

To get started, explore AI audit.

You can now create optimized cache rules instantly with one-click templates, eliminating the complexity of manual rule configuration.

1. Navigate to Rules > Templates in your Cloudflare dashboard.
2. Select a template for your use case.
3. Click to apply the template with sensible defaults.
4. Customize as needed for your specific requirements.

• Cache everything: Adjust the cache level for all requests.
• Bypass cache for everything: Bypass cache for all requests.
• Cache default file extensions: Replicate Page Rules caching behavior by making only default extensions eligible for cache.
• Bypass cache on cookie: Bypass cache for requests containing specific cookies.
• Set edge cache time: Cache responses with status code between 200 and 599 on the Cloudflare edge.
• Set browser cache time: Adjust how long a browser should cache a resource.

To get started, go to Rules > Templates ↗ in the dashboard. For more information, refer to the Cache Rules documentation.

Now, you can create common rule configurations in just one click using Rules Templates.

What you can do:

• Pick a pre-built rule – Choose from a library of templates.
• One-click setup – Deploy best practices instantly.
• Customize as needed – Adjust templates to fit your setup.

Template cards are now also available directly in the rule builder for each product.

Need more ideas? Check out the Examples gallery in our documentation.

You can now achieve higher cache hit ratios with Generic Global Tiered Cache. Regional content hashing routes content consistently to the same upper-tier data centers, eliminating redundant caching and reducing origin load.

Regional content hashing groups data centers by region and uses consistent hashing to route content to designated upper-tier caches:

• Same content always routes to the same upper-tier data center within a region.
• Eliminates redundant copies across multiple upper-tier caches.
• Increases the likelihood of cache HITs for the same content.

A popular image requested from multiple edge locations in a region:

• Before: Cached at 3-4 different upper-tier data centers
• After: Cached at 1 designated upper-tier data center
• Result: 3-4x fewer cache MISSes, reducing origin load and improving performance

To get started, enable Generic Global Tiered Cache on your zone.