Cloudflare lets rules match reported security detection failures

Cloudflare announced a new Rules language field on October 9, 2026, letting customers choose how to handle requests when a security detection reports a failure. The field, cf.appsec.request.failed_detections, makes those reports available as conditions in rules.

The addition changes what rules can respond to, not how the detections operate. Cloudflare says their existing behavior remains unchanged. The field returns an array of detection IDs, or an empty array when no failures are reported.

A rule can match every request with a reported failure using len(cf.appsec.request.failed_detections) gt 0, or target a particular detection. Cloudflare's example for the latter uses waf_credential_check, the ID for the leaked-credentials check. The field supplies the condition; the rule author chooses how to handle the request.

Coverage includes content scanning, WAF attack scores, attack signatures and leaked credentials. It also includes AI prompt detections for personally identifiable information, prompt injection, custom topics and unsafe topics.

Cloudflare says the field is available on all plans, but it does not unlock detections or rule features a customer's plan lacks. It works in custom rules and rate limiting rules at both the zone and account levels, and in Request Header Transform Rules at the zone level.