At Cloudflare we're dedicated to constantly improving our product. Read below to find out the latest updates.
Cloudflare AMP Real URL is now generally available
Mon, August 26, 2019
Cloudflare AMP Real URL is now in general availability to all Cloudflare customers. It uses signed exchanges to guarantee the authenticity of your AMP pages when they are served from a supporting AMP cache. Web visitors will not only experience fast mobile page loads, but the website URL will now be shown natively when served from AMP cache.
The next time you load up the Firewall rules or Rate Limiting rules tab in the dashboard, you will see a new sparkline for each rule showing activity over the last 24 hours. This can be a very useful indicator of whether or not your rules are working as expected. You can also click on any sparkline to see a filtered view of your Analytics or Event Log (for self-serve) for that specific rule. This feature is available for all customers.
Supercharging Firewall Events for Free, Pro, and Business customers
Thu, August 22, 2019
Cloudflare's new Firewall Event Log for Free, Pro, and Business customers provides a new smoother user experience and advanced functionality giving you more granularity when you search and filter your Firewall Events. With these extra capabilities, Firewall Events allows you to more accurately identify new or repeated threat attempts against your application.
Cloudflare customers are now able to:
Search for any field of an Event, including fuzzy matches
Use a date/time picker, so you no longer need to sift through results to find something for a particular date or time.
See Events for all Firewall features (previously, some features were missing from the events view).
Have a much smoother user experience when trying to understand more about why a request was blocked
Cloudflare Magic Transit is now available for Enterprise customers. Magic Transit provides secure, performant, and reliable IP connectivity to the Internet. Out-of-the-box, Magic Transit deployed in front of your on-premises network protects it from DDoS attack and enables provisioning of a full suite of virtual network functions, including advanced packet filtering, load balancing, and traffic management tools.
Enterprises are often forced to pick between performance and security when deploying IP network services. Magic Transit is designed from the ground up to minimize these trade-offs: performance and security are better together. Magic Transit deploys IP security services across our entire global network. This means no more diverting traffic to small numbers of distant “scrubbing centers” or relying on on-premise hardware to mitigate attacks on your infrastructure. Visit the product page to learn more.
CT Monitoring is now in beta for all customers. This is an opt-in service that crawls the public logs of certificate authorities and sends you an email whenever a certificate is issued for one of your domains. This information is important because a suspicious certificate issued to your domain could mean that a certificate authority made an error or that someone is perpetrating an attack on your service. With CT monitoring, you can spot bad certificates as they arise and quickly alert the certificate authority to minimize any harm.
Announcing Subdomain Support for Enterprise Customers
Thu, August 1, 2019
Enterprise customers now have Subdomain Support enabled by default. Cloudflare Subdomain Support simplifies management of Cloudflare performance and security for subdomains and provides several additional benefits.
Subdomain Support allows designated teams within your organization to control Cloudflare settings for a specific subdomain, while your central IT team maintains control of your root or parent domain. For example, Cloudflare settings for support.example.com can be managed completely separately from example.com. For more information and instructions, see the support document.
Announcing IP Firewall whitelisting and IPv4/IPv6 filtering for Spectrum
Tue, July 2, 2019
The IP Firewall for Spectrum apps now supports whitelisting. Previously, you could only use the IP Firewall to block a specific set of IPs (blacklisting). Starting today, you also have the option to effectively block everyone on the Internet outside of a list of approved IPs (whitelisting).
Additionally, we’ve added filtering for IPv4 and IPv6 on Spectrum apps. Several customers have indicated that they only want to enable IPv4 or IPv6 on their apps, so now you can indicate whether you want your app to use IPv4, IPv6, or both.
We have rolled out the beta of AMP Real URL to all users. Accelerated Mobile Pages (AMP) is a Google feature that allows you to serve your mobile site from Google’s cache. Not only does this speed up the delivery of your site, but it is also viewed favorably by Google’s search algorithm. One side effect of using AMP is that users will see a path that starts with ‘google.com/amp' in the URL bar. This can confuse your users and hurt your brand.
Cloudflare’s AMP Real URL lets you retain your URL attribution on AMP pages by digitally signing content submitted to Google’s web crawler, proving that the content belongs to you. You can access AMP Real URL in the ‘speed’ tab of your dashboard; for more details on how it works please see the blog post.
Firewall Events can now be seen in Cloudflare Logs
Tue, June 18, 2019
Firewall events can now be seen in Cloudflare Logs, which is available for all Enterprise customers. Previously, customers using Cloudflare Logs had to decode our pathingStatus and pathingOps to understand what was happening during a request; the only way to get more details was by manually checking Firewall Events. But now you can see a breakdown of every service and rule that touched a request directly from Cloudflare Logs, providing you with better and clearer insights.
Cloudflare is now certified SOC 2 Type 2 compliant
Fri, June 14, 2019
We now have our report on SOC 2 Type 2 compliance. We previously received our SOC 2 Type 1 compliance, indicating that we designed and implemented strong controls around security, confidentiality, and availability. The new Type 2 compliance confirms that those controls have been tested over a period of time to demonstrate that they are operating effectively. These reports give our customers higher assurance that our internal controls are meeting security best practices/industry standards. Contact your customer representative to see the full report.
A new read-only role is now available for all Enterprise accounts. This will enable you to grant read-only access to users in your organization. This role will have all-access read privileges, but a persistent icon in the top-bar will confirm that a user is in read-only mode. This feature is already live; when you add a new user you can now select “Administrator Read Only” as their role.
New Improvements to Firewall Analytics, Rules, and Managed Rulesets
Thu, June 6, 2019
We’ve made some great new additions to Firewall Analytics, Rules, and Managed Rulesets. These updates are all live and available to use today. The complete list is as follows:
A new data picker in Firewall Analytics lets you select a specific date and time
A search update lets you use “contains,” “starts with,” and “ends with” for string fields (e.g. user-agent)
The Managed Rules topN now displays the Managed Rule ID, making it easier to identify
topNs can now be extended to 10 or 15 items using a dropdown
Firewall Rules and Managed Rulesets:
Descriptions within Managed Rules have been updated in a structured format, and contain more useful info
MaxMind's subdivision 1 and 2 data can be utilized within Firewall Rules using the Expression Editor, which allows you to block or whitelist regions, continents, and the EU
Bring Your Own IP (BYOIP) with Spectrum is now in beta for Enterprise customers. When creating a Spectrum application, Cloudflare normally assigns an arbitrary IP from Cloudflare’s IP pool to your application. This may not always be what you want: you may want to be explicit in your network setup or use your own IP addresses. BYOIP with Spectrum allows you to do just that.
If you own an IP prefix, you can migrate it to Cloudflare. Once the migration is complete, Cloudflare will start broadcasting your IP prefix and traffic will get routed to the global Cloudflare network. Without configuration, however, Cloudflare will not know how to handle this traffic. You’ll need to add Spectrum applications for all applications that you wish to protect, making sure to use the IP addresses you want associated with each application. See the docs or contact your customer representative to learn more.
We have some major announcements for Workers customers and Workers developers. Workers now has an open-source CLI (command-line interface) called Wrangler, which will enable devs to build Workers in a way that is more native to their workflow. In addition, we are introducing a free tier for Workers as well as the ability to deploy to workers.dev. This means you can try Workers for free, and you won’t need to deploy to a domain. We are also enabling multi-scripting for Free, Pro, and Business plans so you can enjoy the benefit of having multiple scripts per zone. Previously, this feature was only available for Enterprise customers.
On top of all that, we have created a new UI, new documentation, and a new landing page for Workers (workers.cloudflare.com). Our goal is to eliminate barriers and make it easier to get started and build things with Workers. See the new docs for more details.
We are constantly working on improvements to our API so that all Cloudflare customers can have easy access to their data. Previously, Audit Logs API only supported querying by "day". It now supports down to the minute resolution for the since and before fields. The Audit Logs API will also be modified to return records with a maximum age of 18 months. Previously, queries were unbounded and this had a detrimental performance impact.
In addition, ALL Cloudflare APIs now include a standard response envelope, which includes an errors field. Previously, Audit Logs would return null for errors, instead of an empty array, which is the standard.
Workers KV is now out of beta and in GA for all Cloudflare customers. Workers KV is a highly distributed, eventually consistent, key-value store that spans Cloudflare's global edge. It allows you to store billions of key-value pairs and read them with ultra-low latency anywhere in the world so you can build entire applications with the performance of a CDN static cache.
Workers KV enables you to store persistent data on the edge and quickly access that data with an API call. Some examples of functionality you can build with Workers KV include mass redirects and user authentication for apps. You can try Workers KV today by accessing it in the Workers tab in your dashboard.
A new feature in Firewall Rules called “Functions” is now available to customers on all plans. Functions will allow a customer to have better control and flexibility to evaluate attributes. Our first two transformations are an "upper" and "lower" function.
One of the biggest challenges with Wordpress and other applications, is that they automatically sanitize URLs to improve user-experience. The negative impact of this is it makes security more challenging. These functions will disable case sensitivity for that field, and you can now evaluate in either UPPER case or lower case. This does not change the actual request, it purely changes the case during the evaluation of the attribute. For examples and documentation please see the developer docs.
ISO 27001 is a security certification that is used as an international standard for managing risks to information security. It is published by the International Organization for Standardization (ISO). Receiving this certification means that an organization has met a set of strict requirements in the implementation of their Information Security Risk Management System (ISMS).
To maintain this certification, an organization must be regularly audited by a certifying body who will ensure that the proper standards are being met. This means that Cloudflare customers can have peace of mind knowing that we are preserving the confidentiality, integrity, and availability of your information. You can see the full list of our security certifications on our Compliance page.
We’ve exposed HTTP flood analytics in the Firewall Analytics dashboard. Now you can leverage the filters, toggle time periods, and view topN insights for HTTP floods.
We’ve also upgraded our UDP protection. In addition to the existing UDP protocol violation protection, we’ve added more protection against UDP floods. This fortification is intended to support Spectrum UDP applications, BYOIP, NTP/NTS and QUIC (by Q3). TCP/UDP analytics is planned for later this year as well.
Faster cache hits for CNAME origins
Tue, April 9, 2019
We’ve launched a major performance enhancement for all Cloudflare customers who use CNAME DNS records to point to their origin. For example, customers may configure "origin.customer.com" to reach their origin instead of an A record like 184.108.40.206.
Before this change, every single request to our edge would trigger a DNS lookup for an origin IP. This behavior is particularly problematic if a CNAME is configured as the origin. In this case, we could add 100s of milliseconds in latency, since we may need multiple Internet requests to fetch the origin IP. Now, we only look up the origin IP when we need it. This cuts the total number of DNS requests in half and reduces the total time we spent looking up DNS records by about 1/3rd globally.
Announcing Concurrent Streaming Acceleration
Tue, March 26, 2019
We have improved the way we deliver large file downloads for all of our customers. Concurrent Streaming Acceleration is a new way of delivering large, uncached files to multiple clients simultaneously. Previously, when several users requested an uncached file, the first user to ask for the file would have to finish downloading for the file to be cached and delivered to the other users. With Concurrent Streaming Acceleration, several users can simultaneously download the file while it is being added to the Cloudflare CDN cache.
This change is live across all of Cloudflare, and will be particularly helpful for streaming live video to multiple users via Cloudflare Stream. Several users have noticed a drop in “cache lock wait time,” i.e. how long a request must wait for other requests – since we rolled out this change.
Cloudflare is now certified SOC 2 Type 1 compliant
Thu, March 14, 2019
This week we received our SOC 2 Type 1 compliance report. This report evaluates Cloudflare on three trust service principles of SOC 2: Security, Availability, and Confidentiality. SOC 2 is a compliance certification that focuses on internal controls of an organization related to five trust principles: Security, Confidentiality, Processing Integrity, Availability, and Privacy.
To maintain this certification, an organization must be regularly audited by a certifying body who will ensure that the proper standards are being met. This certification means Cloudflare customers can rest assured that their data is being kept private and protected. Enterprise customers can get in touch if they want to see a copy of the report.
This week we release Layer 4 DoS analytics in the dashboard for Enterprise customers. Enterprise users will now be able to see both Layer 7 analytics in the form of dropped HTTP requests per second as well as Layer 4 analytics in the form of dropped TCP packets per second.
Layer 4 (transport layer) attacks exploit a vulnerability in the TCP handshake in an attempt to max out the maximum number of TCP connections. Meanwhile layer 7 (application layer) attacks attempt to overwhelm a service with HTTP requests. Seeing analytics for both can help you understand what kind of attacks you are facing and what type of protection you need.
Source IP preservation for Spectrum UDP packets
Mon, March 4, 2019
Some services you run may require knowledge of the true client IP. However, since Cloudflare intercepts packets before forwarding them to your server, you may see Cloudflare’s IP rather than the true client IP. In these cases, you can use a proxy protocol for Cloudflare to pass on the client IP to your service.
Previously, we enabled Proxy Protocol support for Spectrum TCP packets. Since Proxy Protocol doesn’t support UDP, we have now created our own Simple Proxy Protocol to allow IP preservation for Spectrum UDP packets; this feature is available for all customers. To enable, simply flip the switch in the Spectrum dashboard. See the docs for more details.
Insights into security events are critical for monitoring the health of web applications. Today, Cloudflare announced new Firewall Analytics which will help our Enterprise customers get detailed insights into firewall events, helping them to tailor their security configurations more effectively.
Cloudflare Logs - Granular Insights Into Your Traffic
Mon, February 25, 2019
Improve your application’s performance and security by tuning your Cloudflare configuration. Investigate and debug errors and security mitigations reported by your end users. Build customized analytics in the tools you already use.
Access improves the security of service-to-service connections by adding service token authentication to the protections offered by Cloudflare. With service tokens, customers can now extend access control to automated tools, scripts, and bots.
Cache API now works with Workers to give customers greater, more fine grained control over Cloudflare's caching behavior. This API will now allow customers to cache objects that were traditionally uncacheable, for example caching POST requests.
Customers on Free, Pro and Business plans can now purchase load balancing support for up to 20 origins. This increased support allows customers to build a more resilient global infrastructure that ensures their customers are served content from locations closest to them, with the lowest latency.
We’re excited to announce early access for Traffic Acceleration with Cloudflare Mobile SDK. Acceleration uses novel transport algorithms built into the SDK to accelerate apps beyond the performance they would see with TCP. Enabling Acceleration through the SDK reduces latency, drives down network timeouts, and improves app user experiences.
Access now supports mutual TLS (mTLS) authentication. Mutual TLS authentication ensures that the traffic is secure and trusted in both directions between a client and server. This type of authentication can be used for allowing requests such as Internet of Things devices, that do not login with an identity provider, to demonstrate that they have permissions to reach a given resource.
Organizations will be able to use mutual TLS authentication as a second layer of authentication for users or as the primary method of authentication for connected devices.
Access can authenticate users who want to use SSH (Secure Shell). This removes the need for a VPN by developers, IT, and support to use this service while providing secure authentication and integration with major identity providers.
Access enables a Zero Trust Command Line Interface (CLI) authentication to APIs
Fri, October 5, 2018
Increase performance for users using APIs over CLI by authenticating near them, not in a far away VPN server. Simplify and reduce costs for deployment, configuration, and maintenance. Tightly control authorization through granular policies based on attributes such as users, IP ranges, and application URLs.
The Cloudflare dashboard now supports Single Sign On (SSO) for ease of centralized identity and access management. Reduce user provisioning times and avoid password sprawl, with a seamless SSO experience that supports your existing identity providers.
Cloudflare Workers now support the inclusion of WebAssembly modules. WebAssembly support allows developers to run code inside of Cloudflare Workers written in almost any language including: Rust, Go, C, C++, and others.
Cloudflare Workers KV provides access to a secure low latency key-value store at all 154 Cloudflare data centers. Developers can use Cloudflare Workers and Workers KV to augment existing applications or to build entirely new applications on top of Cloudflare's global cloud network. Workers KV scales seamlessly to support applications serving dozens or millions of users.
Cloudflare Registrar lets you securely register and manage your domain names with transparent, no-markup pricing that eliminates surprise renewal fees and hidden add-on charges. Be one of the first to transfer your domains to Cloudflare. Sign up today for the Cloudflare Registrar Early Access.
Server Name Indication (SNI) does not conceal the requested hostname in the ClientHello message during TLS negotiation. This allows intermediaries to have visibility into the hostnames of websites visited by users. Exposing the hostname means that the privacy of users can be compromised, content can be censored, or traffic can be served with discriminatory quality-of-service.
Encrypted SNI keeps the hostname private when a user is visiting an ESNI-enabled site on Cloudflare by concealing the browser’s requested hostname from anyone listening on the Internet.
All domains on Cloudflare using our authoritative name servers get Encrypted SNI enabled as default.
Cloudflare improves the accuracy of time for TLS handshakes through a rough, authenticated time-synchronization based on Google’s Roughtime protocol. By running a Roughtime service, we enable clients to securely keep approximately correct time, which reduces erroneous authentication from 'clock skew' and increases security through wider adoption of short-lived HTTPS certificates.
Cloudflare now supports load balancing for non-HTTP/S traffic across multiple origins for increased availability and performance when deployed with Spectrum.
The Cloudflare Onion Service
Thu, September 20, 2018
Cloudflare will run an Onion Service on its network. Tor users visiting sites that have enabled this feature will be scored for reputation differently from general Tor traffic. This will result in fewer CAPTCHAs for human Tor users while protecting the site from malicious actors and reducing exit node tampering.
Cloudflare supports the RPKI-framework for two important parts of Internet transit: signing BGP routes it announces for all Cloudflare domains, and validating announced IP addresses when routing traffic through its global network. Authenticating BGP routes with public key signing helps prevents visitors or origins on RPKI compliant ISP's from being hijacked.
The Cloudflare Provider for Terraform now supports deployment and configuration of Cloudflare Workers. Users of Terraform can now include Cloudflare Workers as another part of their configuration as code approach to infrastructure.
Spectrum supports multiple ports for TCP applications
Thu, August 23, 2018
Spectrum allows TCP applications to support proxying multiple ports on the same hostname. A single application with multiple ports, (e.g. SMTP, which uses ports 25, 465, and 587) can be proxied through Cloudflare using the same hostname to protect it from DDoS attacks.
Cloudflare Stream makes streaming high quality video at a global scale easy and affordable. Eliminate the effort of delivering high quality video with a massive, globally distributed video delivery network. Use a single, integrated workflow through a robust API or drag and drop UI that includes video encoding, global delivery, and customizable player.
No VPN required. Cloudflare Access enables easy, secure, and fast access to internal applications wherever they are, from whatever device. Leverage a Zero Trust security framework with existing identity providers like Google™, Facebook™, Okta™, Github™, and more. Get your first 5 users per month for free.
Access supports reusable nested groups and bypass policies
Tue, July 24, 2018
Cloudflare Access now provides more granular control by supporting reusable nested user groups and bypass policies that include IP address whitelisting. Access policies based on user groups automatically apply rules to all users in the defined group, simplifying the creation and management of policies. Access rules can also enable traffic to bypass authentication. You can whitelist specific IP addresses, address ranges, or open up specified endpoints to the public internet.
Dynamic steering is a load balancing feature that automates traffic steering across origins in multiple geographic regions. Round-trip time (RTT) for health checks is calculated across multiple pools of load balanced servers and origins to determine the fastest server pools. This RTT data enables the load balancers to identify the fastest pools, and to direct user requests to the most responsive origins.
Cloudflare's DNS now supports the following record types: CERT, DNSKEY, DS, NAPTR, SMIMEA, SSHFP, TLSA, and URI via the web and API.
FQDN Resolution of Load Balanced Origins at the Edge
Thu, June 28, 2018
Cloudflare now resolves fully qualified domain name (FQDN) origins at the edge rather than centrally. This allows load balancers to better support origins that utilize geo-DNS or other dynamic responses.
Developer Portal Q2 Update
Mon, June 11, 2018
The Developer Portal has been updated in Q2 to include improved search, documentation for new products, and listings of upcoming Cloudflare community events.
On June 4, Cloudflare will be dropping support for TLS 1.0 and 1.1 on api.cloudflare.com. Additionally, the dashboard will be moved from www.cloudflare.com/a to dash.cloudflare.com and will require a browser that supports TLS 1.2 or higher.
Rate Limiting has two new features: challenges (CAPTCHA and JS Challenge) as an Action; and matching Header attributes in the response (from either origin or the cache) as the Trigger. These features give more control over how Cloudflare Rate Limiting responds to threshold violations, giving customers granularity over the types of requests to "count" to fit their different applications.
To learn more, go to the blog post.
Starting May 2 2018, users can go to the new home of Cloudflare’s Dashboard at dash.cloudflare.com and share account access. This has been supported at our Enterprise level of service, but is now being extended to all customers.
Support full SSL (Strict) mode validation for CNAME domains
Thu, April 12, 2018
Cloudflare is now able to validate origin certificates that use a hostname's CNAME target in Full SSL (Strict) mode. Previously, Cloudflare would not validate any certificate without a direct match of the HTTP hostname and the certificate's Common Name or SAN. This update allows SSL for SaaS customers to more easily enable end-to-end security.
Argo Tunnel ensures that no visitor or attacker can reach your web server unless they first pass through Cloudflare.
Using a lightweight agent installed on origin infrastructure, including containers or virtual machines, Cloudflare creates an encrypted tunnel between its nearest data center and an application’s origin server without opening a public inbound port.
Cloudflare is strengthening the Certificate Transparency (CT) ecosystem with our introduction of Nimbus, a free and open CT log. Certificate Transparency improves security online by bringing accountability to the system that protects HTTPs. Additionally, we have published Merkle Town, a dashboard for exploring and monitoring the certificate transparency ecosystem.
Create a rule to block or challenge a specific User Agent from accessing your domain. This works similarly to Zone Lockdown, except the block examines incoming User-Agent strings rather than IPs. User Agent blocking applies to an entire zone, and sub-domains cannot not be specified.
Zone Lockdown allows for the whitelisting of specific IP addresses and IP ranges, whereby all other IPs are effectively blacklisted. This supports specific sub-domains and URLs and is useful to protect an administrative area from non-specified IP addresses.
Cloudflare now supports additional HTTP cache-control directives. These headers allow more control over content caching behavior and enable our cache to handle more complex instructions for handling online assets.
Cloudflare now supports Certification Authority Authorization (CAA). CAA records allow domain owners to specify which CAs are authorized to issue certificates for their domain (or subdomain, as CAAs can be defined at any level of the hierarchy).
When people use anonymity services or shared IPs, it makes it more difficult for website protection services like Cloudflare to identify their requests as coming from legitimate users and not bots. The Privacy Pass browser extension reduces the number of challenge pages presented by Cloudflare by letting users prove their identity across multiple sites anonymously. The Privacy Pass extension is available for both Chrome and Firefox.
Cloudflare Load Balancing now supports session affinity, using automatically generated cookies. If session affinity is enabled, the same target receives the request and can use the automated cookie to recover an existing session with the origin server.
Geo Key Manager provides the ability to choose which Cloudflare data centers have access to private keys in order to establish HTTPS connections. Cloudflare has preconfigured options to select from either US or EU data centers as well as the highest security data centers in the Cloudflare network. Data centers without access to private keys can still terminate TLS, but they will experience a slight initial delay when contacting the nearest Cloudflare data center storing the private key.