Cloudflare changelogs | Application performance

SSL/TLS - Certificate Transparency Monitoring is now Generally Available

Thu, 13 Aug 2026 00:00:00 GMT

Certificate Transparency Monitoring is now generally available ↗ across all Cloudflare plans.

Alerts for certificates Cloudflare issues on your behalf (Universal SSL renewals, backup certificates, Advanced Certificate Manager, Total TLS) are now automatically filtered out. Alert emails are also clearer and more actionable, with structured certificate details and a direct link to manage CT Monitoring in the Cloudflare dashboard.

Learn more in the launch blog post ↗ or the CT Monitoring docs.

SSL/TLS - Faster and more secure TLS handshakes to your origins, automatically

Tue, 21 Jul 2026 00:00:00 GMT

Cloudflare now takes the guesswork out of TLS 1.3 key agreement with your origins. Automatic key exchange predicts the preferred algorithm and sends its key share in the first ClientHello, helping avoid a HelloRetryRequest and one extra network round trip.

Automatic key exchange is on for all existing zones and on by default for new zones. When an origin supports both classical and post-quantum key agreements, Cloudflare prefers the post-quantum X25519MLKEM768 hybrid key agreement.

To change this behavior, go to SSL/TLS > Overview > Origin connection & post-quantum encryption. Turn off Automatic key exchange to stop automatic scans and preference updates. Turning it off does not change your compliance requirements.

Compliance requirements apply only to TLS 1.3 connections. The Post-quantum hybrid option requires hybrid post-quantum key agreements support on your origin server. The Federal Information Processing Standards (FIPS) option requires FIPS-compliant key agreements. Select both to require key agreements that satisfy both, or leave both unselected to allow all supported key agreements.

For requirements, configuration options, and rollout details, refer to Automatic key exchange to origins.

Gateway, DNS - Internal DNS is now generally available

Wed, 15 Jul 2026 00:00:00 GMT

Internal DNS is now generally available. Internal DNS provides authoritative and recursive DNS for private networks on the same global network and control plane you already use for public DNS, Zero Trust, and application services.

Why it matters

Consolidate DNS operations. Public and private DNS run on one platform, with one API, one audit trail, and one place to set policy.
Simplify split-horizon DNS. Internal and external resolution are defined as separate views over shared zones, managed from a single control plane — so there is no drift to chase down.
Extend Zero Trust to DNS. Resolver policies decide which users and devices resolve against which view, enforced by the same Gateway that already governs the rest of your traffic.

Setting up Internal DNS takes three steps: create a zone, create a view, and define a resolver policy.

POST /zones
{
  "account": {
    "id": "<ACCOUNT_ID>"
  },
  "name": "corp.internal",
  "type": "internal"
}

Internal DNS is included with Cloudflare Gateway for Enterprise customers. To get started, refer to the Internal DNS documentation.

Cloudflare Web Analytics - Improved reliability for account-wide Web Analytics dashboards

Tue, 14 Jul 2026 00:00:00 GMT

Cloudflare Web Analytics (Real User Monitoring) has rolled out performance optimizations to significantly improve the stability and loading speed of account-wide dashboards.

For larger accounts (with >100 Web Analytics sites), loading the aggregate account-wide view would often fail, running into timeouts or unexpected interface errors due to the massive scale of parallel query processing. This update optimizes how high-volume multi-site data is queried to reduce errors and provide a snappier dashboard experience.

Accounts with up to 1,000 sites will now be able to load this account-wide aggregate view without experiencing misleading errors.

If you have an account with over 1,000 sites, we cannot currently aggregate over this volume due to processing constraints but you will now be presented with a clear error and instruction to filter to the relevant site(s) you wish to see the data for.

DNS - New DNS Firewall UX with more dashboard settings

Thu, 09 Jul 2026 00:00:00 GMT

The DNS Firewall page in the Cloudflare dashboard has been refreshed, bringing several settings that were previously API-only into the UI and modernizing how you view and manage your DNS Firewall clusters.

What is new

More settings in the dashboard: cluster options that were previously only configurable through the API — such as attack mitigation, rate limiting, negative TTL, and resolver subnet — are now available directly in the dashboard.
Better table experience: the DNS Firewall cluster table has been revised to surface cluster details at a glance, with resizable columns and the option to show or hide columns to tailor the view to your workflow.
New create and edit UX: adding and editing clusters now uses a modernized form that groups related settings together, making configuration faster and clearer.

Availability

Available to all DNS Firewall customers as part of their existing subscription.

Where to find it

In the Cloudflare dashboard, go to the DNS Firewall page.

Go to Clusters ↗

For more information, refer to DNS Firewall.

Cache - Cache multiple versions of a URL with Vary

Thu, 02 Jul 2026 00:00:00 GMT

Your origin can serve different responses for the same URL — different languages based on Accept-Language, or different formats based on Accept — by returning a Vary ↗ response header. Cloudflare's cache now honors that header directly in Cache Rules, so the same URL can hold multiple cached versions and each request is matched to the right one. Content that previously had to bypass cache to stay correct can now be cached, following standard HTTP caching behavior ↗.

What changed

Your origin now decides which request headers matter by listing them in its Vary response, and you control how Cloudflare treats each one. When you have enabled Vary using a cache rule and a response includes a Vary header, the request headers listed become part of the cache key.

For each header your origin varies on, choose one of three actions:

Action	Behavior	Best for
`normalize`	Converts equivalent header values to the same cache key value before matching, collapsing redundant versions.	Most `Accept`, `Accept-Language`, and `Accept-Encoding` use cases.
`passthrough`	Uses the raw header value to select the cached version and forwards it to the origin unchanged.	When byte-for-byte differences in the header value should create versions.
`bypass`	Bypasses cache whenever this header name appears in the origin's `Vary` response.	Per-user values, or headers with too many possible values to cache safely.

Benefits

Higher cache hit ratios: normalize treats semantically equivalent headers as one version. For example, Accept-Language: en-US, fr;q=0.8 and Accept-Language: fr;q=0.8, en-GB both resolve to the same cache key, so you serve more requests from cache instead of the origin.
Correct content negotiation: Requests always receive the cached version that matches their headers, so language and format variants stay accurate.
No origin or Worker changes required: If your origin already sends Vary, you configure the behavior entirely in Cache Rules.
Standards-aligned: Cache key calculation follows RFC 9111, and Vary: * continues to bypass cache as required by RFC 9110.

Availability

Vary in Cache Rules is available on all plans (Free, Pro, Business, and Enterprise). For per-request control in Workers subrequests, use the cf.vary property.

Get started

Configure Vary in the Cloudflare dashboard ↗ under Caching > Cache Rules, or through the Rulesets API. To learn how Vary affects cache keys and how each action works, refer to Vary and the Cache Rules Vary setting.

Speed - Cloudflare AMP/SXG is now end of life.

Tue, 23 Jun 2026 00:00:00 GMT

Cloudflare Accelerated Mobile Pages (AMP) and Signed Exchanges (SXG) support has reached end of life. The features have been disabled since October 2025, so customers who had them configured should see no change to their traffic.

Customers will no longer be able to configure AMP/SXG through API or rulesets. The Zone API will start throwing errors. Rulesets with the SXG configuration will fail to save until SXG has been removed.

Speed - Cloudflare Fonts error handling and security improvements

Thu, 18 Jun 2026 00:00:00 GMT

Cloudflare Fonts now forwards /cf-fonts requests to your origin server when it encounters invalid paths or unexpected runtime errors, instead of returning 4xx or 5xx responses directly. This update also adds additional input validation to enhance security.

SSL/TLS - Post-quantum ML-DSA certificates for Authenticated Origin Pulls and Custom Origin Trust Store

Wed, 17 Jun 2026 00:00:00 GMT

Cloudflare now accepts ML-DSA ↗ (FIPS 204) post-quantum certificates on the connection between Cloudflare's edge and your origin server. Combined with our existing X25519MLKEM768 key agreement, this lets you establish end-to-end post-quantum authentication on the Cloudflare-to-origin connection.

ML-DSA is supported in two origin-facing features:

Authenticated Origin Pulls (AOP) — upload an ML-DSA client certificate that Cloudflare will present during the mTLS handshake to your origin. Available at both zone-level and per-hostname scopes.
Custom Origin Trust Store (COTS) — upload an ML-DSA certificate authority that Cloudflare will trust when validating your origin server certificate under Full (strict) encryption mode.

Refer to Post-quantum signatures for certificate generation and setup guidance, and to PQC in Cloudflare products for the current post-quantum deployment status across Cloudflare.

DNS - Account-level DNS records quota

Wed, 10 Jun 2026 00:00:00 GMT

Cloudflare now enforces DNS records quotas at the account level for Enterprise accounts. Instead of a per-zone limit, these accounts have a quota on the total number of records across all of their zones, letting you distribute records across your zones however you like — regardless of each zone's plan. Public and internal zones are counted separately, each with a default quota of 1,000,000 records.

Accounts without an account-level quota are unaffected: existing per-zone quotas behave exactly as before.

For more details, refer to DNS records quota.

Cache - BYPASS status now returned for uncacheable responses

Tue, 26 May 2026 00:00:00 GMT

Cloudflare now returns a BYPASS cache status whenever a response is not cacheable, instead of the previous mix of BYPASS and MISS that depended on why Cloudflare chose not to cache the response.

There are multiple reasons Cloudflare may refuse to cache a response — for example, the response exceeds the maximum cacheable file size for your plan, the origin sends Cache-Control: no-cache, private, or max-age=0, the response includes a Set-Cookie header, or the request includes an Authorization header.

Previously, only some of these conditions returned BYPASS. Others — such as responses exceeding the maximum cacheable file size — returned MISS on every request, regardless of whether Origin Cache Control was on or off. Because the response could never be cached, every subsequent request also returned MISS, which looked indistinguishable from a broken cache and made it hard to tell whether Cloudflare was trying and failing to cache the asset or had deliberately chosen not to cache it.

BYPASS now consistently signals that Cloudflare refused to cache the response, regardless of the reason. MISS is reserved for cacheable responses that simply were not in the local cache at request time.

What to expect in your analytics

After this change rolls out, you should see:

MISS rate decreases: Uncacheable responses no longer count as cache misses.
BYPASS rate increases: These same responses are now reported as bypasses.
Cache hit ratio increases: Hit ratio calculations no longer include uncacheable traffic that could never have been cached, giving you a more accurate view of cache effectiveness.

Your total request volume and origin traffic are unchanged — only the cache status label is different.

Browser cache TTL behavior is preserved

The cache status label is the only thing changing — browser cache TTL handling for any given response is identical to what it was before:

Responses that historically returned MISS because Cloudflare refused to cache them (for example, responses over the maximum cacheable file size) now return BYPASS, but continue to have browser cache TTL applied — exactly as they did when they were labeled MISS.
Responses that historically returned BYPASS and skipped browser cache TTL continue to skip browser cache TTL.

In both cases, the decision to apply browser cache TTL depends on the underlying reason Cloudflare did not cache the response, not on the new BYPASS label.

DNS - New DNS records UX is rolling out

Wed, 20 May 2026 00:00:00 GMT

Starting today, everyone can opt in to a refreshed DNS records page in the Cloudflare dashboard. Over the coming weeks, the new experience will become the default for Free plan users first, followed by paid plans.

What is new

Better table experience: resizable and hideable columns, row pinning, advanced filters with logical operators (AND/OR), configurable pagination, and expanded input fields so long values are no longer cut off.
First-class mobile experience: responsive layout with a touch-friendly, card-based UI and compact controls for small screens.
DNS quick reference: bite-sized explainers for DNS, proxy status, and TTL, available directly in the product to help users configure records without leaving the page.
Modern frontend: a refactor onto Cloudflare's new UI framework that improves performance and lays the foundation for future improvements.

Rollout plan

Dates are subject to change based on feedback received during the rollout.

20 May - 05 June: ramped rollout to Free, then Pro and Business plans.
08 June - 03 July: ramped rollout to Enterprise plans.

Once the new experience is turned on for your account, look for the feedback link at the top of the DNS records page in the Cloudflare dashboard and let us know what you think. Your input helps us prioritize the next round of improvements.

Cloudflare Web Analytics - /cdn-cgi/rum endpoint now returns 405 for non-POST requests

Wed, 13 May 2026 00:00:00 GMT

The /cdn-cgi/rum beacon endpoint now returns 405 Method Not Allowed for non-POST requests instead of 404 Not Found. The response includes an Allow: POST, OPTIONS header per RFC 9110 §15.5.6 ↗.

Previously, sending a GET or other non-POST request to this endpoint returned a 404, which was misleading because it suggested the endpoint did not exist. The new 405 response clearly indicates that the endpoint exists but only accepts POST requests.

The Web Analytics beacon (beacon.min.js) already uses POST for all metric submissions, so this change does not affect normal beacon operation. OPTIONS requests for CORS preflight continue to work as before.

For more information, refer to the Web Analytics FAQ.

Cache - Pingora now powers Cloudflare's cache

Mon, 04 May 2026 00:00:00 GMT

Cloudflare's cache now runs on a new proxy built on Pingora ↗, the Rust-based framework that already serves a significant portion of Cloudflare's network traffic. The new proxy is faster, more memory-safe, and designed to evolve our cache architecture. It delivers immediate performance improvements and enables new caching capabilities.

What this brings

Lower latency: The new proxy reduces per-request overhead through improved connection reuse.
Reduced cache MISSes: Enhanced cache retention improves origin offload.
Better RFC compliance: Caching behavior more closely follows HTTP caching standards.
Foundation for future features: The new architecture enables upcoming improvements to cache functionality and efficiency.

New features

Asynchronous stale-while-revalidate: Every request returns stale content immediately while revalidation happens in the background, instead of the first request after expiry blocking on the origin. Refer to the asynchronous stale-while-revalidate changelog for details.
Unbuffered bypass by default: Responses that bypass cache are streamed directly to the client without buffering, reducing time-to-first-byte for uncacheable content.

Behavioral changes

The new architecture introduces the following behavioral changes to improve RFC compliance and correctness:

Vary: * results in cache bypass: According to RFC 9110 Section 12.5.5 ↗, a Vary header value of * indicates the response varies on factors beyond request headers and must not be served from cache. Cloudflare now bypasses cache for these responses instead of storing them.
Set-Cookie stripped on MISS and EXPIRED: For cacheable assets, Set-Cookie is now stripped on MISS and EXPIRED responses, not only on HITs.
Floating-point TTL values: Floating-point time-to-live values (for example, max-age=1.5) are rounded down to the nearest integer instead of being rejected as invalid.

What's next

A deeper look at the new cache proxy is coming soon to the Cloudflare blog ↗. For background on the underlying framework, read:

Speed - Shared dictionaries passthrough now in open beta

Thu, 30 Apr 2026 00:00:00 GMT

Shared dictionaries (RFC 9842 ↗) let an origin compress a response against a previous version of the same resource that the browser already has cached, so only the difference between versions travels over the wire. Shared dictionaries passthrough is now in open beta on all plans.

What changed

In passthrough mode, Cloudflare:

Forwards the Use-As-Dictionary and Available-Dictionary headers between client and origin without modification.
Treats dcb (Dictionary-Compressed Brotli) and dcz (Dictionary-Compressed Zstandard) as valid Content-Encoding values end to end, without recompressing them.
Extends the cache key to vary on Available-Dictionary and Accept-Encoding so each delta-compressed variant is cached correctly.

Your origin manages the dictionary lifecycle: deciding which assets are dictionaries, attaching Use-As-Dictionary headers, and producing deltas in response to Available-Dictionary requests. Cloudflare handles the transport and the cache.

In internal testing on a 272 KB JavaScript bundle, the asset shrinks from 92.1 KB with Gzip to 2.6 KB with delta Zstandard against the previous version — a 97% reduction over standard compression — with download times improving by 81–89% versus Gzip.

Shared dictionaries work with browsers that advertise dcb or dcz in Accept-Encoding. Today, this includes Chrome 130 or later and Edge 130 or later.

Get started

Turn on passthrough for your zone with a single API call:

curl "https://api.cloudflare.com/client/v4/zones/$ZONE_ID/settings/shared_dictionary_mode" \
	--request PATCH \
	--header "Authorization: Bearer $CLOUDFLARE_API_TOKEN" \
	--json '{
		"value": "passthrough"
	}'

You can also turn it on under Speed > Settings > Content Optimization in the Cloudflare dashboard ↗. For full origin setup instructions and a working test recipe, refer to Shared dictionaries, or try the live demo at canicompress.com ↗.

Cloudflare Web Analytics - Web Analytics adds Navigation Type filtering and reporting

Thu, 30 Apr 2026 00:00:00 GMT

Cloudflare Web Analytics now supports Navigation Type reporting and filtering.

This update allows developers and performance analysts to see how users are navigating between pages — whether through a link click or form submission, a page reload, or using the browser's back/forward buttons — and whether a browser cache hit occurred for these behaviors.

Understanding navigation types is critical for optimizing user experience. For example, if a high volume of your traffic consists of "Back-forward" navigations versus "Back-forward Cache", those visitors are not benefiting from the Back/Forward Cache (bfcache) and therefore are experiencing higher load times due to potentially unnecessary network requests.

The same applies for regular "Navigate" entries — where "Navigate Cache", "Navigate Prefetch Cache" and "Prerender" would provide instant document retrieval — and "Reload", where "Reload cache" would be more optimal.

A high volume of "Reload" entries can also indicate a potential stability problem with your website.

By identifying these patterns, you can tune your browser caching strategies to ensure HTML documents are served instantaneously from local caches rather than requiring a roundtrip to the network.

For more information, refer to Navigation Types.

Key benefits

Monitor Cache Effectiveness: See how often your site is served from the HTTP cache or bfcache.
Identify Performance Bottlenecks: Filter by the different types to understand performance opportunity of improving browser cache hit ratio.

You can now find the Navigation Type dimension in the Web Analytics dashboard. You can filter to include/exclude one or more specific types using "equals", "does not equal", "in", or "not in" matchers.

To check the list of popular navigation types, select Page views on the Web Analytics sidebar and scroll down to the bottom:

DNS - Account-level enforce DNS-only

Tue, 28 Apr 2026 00:00:00 GMT

You can now disable Cloudflare's reverse proxy across all zones in your account simultaneously using the new enforce_dns_only setting. When enabled, Cloudflare responds to DNS queries for all proxied records with your origin IP addresses instead of Cloudflare's anycast IPs. This account-level kill switch is designed for incident response scenarios where you need to quickly route traffic directly to your origin servers.

Key characteristics

Account-level — Affects all zones in the account simultaneously with a single API call.
Non-destructive — Does not modify your DNS records. Disabling the setting restores normal proxy behavior.
API-only — Available through the API only, not in the Cloudflare dashboard.

What's affected

Included: Standard proxied A, AAAA, and CNAME records, Load Balancing records, and records matching Worker routes.

Excluded: Spectrum applications, Cloudflare Tunnel CNAMEs, R2 custom domains, Web3 gateways, and Workers custom domains continue to operate normally.

Before you enable

Verify your origin servers can handle direct traffic without Cloudflare's caching and filtering.
Review which origin IPs will become publicly visible through DNS queries.
Test the API in a staging account before relying on it for incident response.

Availability

Available via API to all Cloudflare customers.

For information on how to use it, refer to Enforce DNS-only developer documentation .

Cache - Cache Response Rules now support zone versioning

Mon, 27 Apr 2026 00:00:00 GMT

Cache Response Rules now work with Version Management. You can version response-phase cache settings and promote them through environments, just like Cache Rules and other supported configurations.

What changed

Previously, Cache Response Rules were excluded from zone versioning. Any response-phase rule you created applied globally across all environments with no way to test changes in staging first. Cache Rules already supported versioning, but the response phase, where you modify Cache-Control directives, manage cache tags, and strip headers, did not.

Cache Response Rules are now fully integrated with Version Management. You can create or modify response-phase rules within a version, and those changes stay scoped to that version until promoted.

Benefits

Safe rollout of cache behavior changes: Test response-phase rules in a staging environment before promoting to production. Catch unintended caching side effects early.
Parity with Cache Rules: Cache Response Rules now follow the same versioning workflow as Cache Rules, so you can manage all cache configuration through a single promotion pipeline.
Independent environment control: Run different response-phase cache settings per environment. For example, strip Set-Cookie headers in staging to validate cacheability without affecting production traffic.

Get started

Configure Cache Response Rules in the Cloudflare dashboard ↗ under Caching > Cache Rules, or via the Rulesets API. For more details, refer to the Cache Response Rules documentation and the Version Management documentation.

Cache - Smart Tiered Cache optimizes public cloud origins

Fri, 17 Apr 2026 00:00:00 GMT

You can now achieve higher cache HIT rates and reduce origin load for origins hosted on public cloud providers with Smart Tiered Cache. By setting a cloud region hint for your origin, Cloudflare selects the optimal upper-tier data center for that cloud region, funneling all cache MISSes through a single location close to your origin.

Previously, Smart Tiered Cache could not reliably select an optimal upper tier for origins behind anycast or regional unicast networks commonly used by cloud providers. Origins on AWS, GCP, Azure, and Oracle Cloud would fall back to a multi-upper-tier topology, resulting in lower cache HIT rates and more requests reaching your origin.

How it works

Set a cloud region hint (for example, aws/us-east-1 or gcp/europe-west1) for your origin IP or hostname. Smart Tiered Cache uses this hint along with real-time latency data to select a primary upper tier close to your cloud region, plus a fallback in a different location for resilience.

Supported providers: AWS, GCP, Azure, and Oracle Cloud.
All plans: Available on Free, Pro, Business, and Enterprise plans at no additional cost.
Dashboard and API: Configure from Caching > Tiered Cache > Origin Configuration, or use the API and Terraform.

Get started

To get started, enable Smart Tiered Cache and set a cloud region hint for your origin in the Tiered Cache settings.

SSL/TLS - Manage mTLS and BYO CA certificates from the Cloudflare dashboard

Tue, 07 Apr 2026 00:00:00 GMT

You can now manage mutual TLS (mTLS) and Bring Your Own Certificate Authority (BYO CA) configurations directly from the Cloudflare dashboard — no API required.

Previously, these advanced workflows required the Cloudflare API. The following are now available in the dashboard:

AOP certificate management — Upload and manage your own certificate authorities for Authenticated Origin Pulls (AOP) directly from the dashboard.
BYO Client mTLS certificate management — Upload and manage your own CA certificates for client mTLS enforcement without needing API access.
CDN hostname to client mTLS certificate mapping — Associate client mTLS certificates with specific hostnames directly from the dashboard.

DNS - Internal DNS - now in open beta

Tue, 31 Mar 2026 00:00:00 GMT

Internal DNS is now in open beta.

Who can use it?

Internal DNS is bundled as a part of Cloudflare Gateway and is now available to every Enterprise customer with one of the following subscriptions:

Cloudflare Zero Trust Enterprise
Cloudflare Gateway Enterprise

To learn more and get started, refer to the Internal DNS documentation.

Cache - Cache Response Rules

Tue, 24 Mar 2026 00:00:00 GMT

You can now control how Cloudflare handles origin responses without changing your origin. Cache Response Rules let you modify Cache-Control directives, manage cache tags, and strip headers like Set-Cookie from origin responses before they reach Cloudflare's cache. Whether traffic is cached or passed through dynamically, these rules give you control over origin response behavior that was previously out of reach.

What changed

Cache Rules previously only operated on request attributes. Cache Response Rules introduce a new response phase that evaluates origin responses and lets you act on them before caching. You can now:

Modify Cache-Control directives: Set or remove individual directives like no-store, no-cache, max-age, s-maxage, stale-while-revalidate, immutable, and more. For example, remove a no-cache directive your origin sends so Cloudflare can cache the asset, or set an s-maxage to control how long Cloudflare stores it.
Set a different browser Cache-Control: Send a different Cache-Control header downstream to browsers and other clients than what Cloudflare uses internally, giving you independent control over edge and browser caching strategies.
Manage cache tags: Add, set, or remove cache tags on responses, including converting tags from another CDN's header format into Cloudflare's Cache-Tag header. This is especially useful if you are migrating from a CDN that uses a different tag header or delimiter.
Strip headers that block caching: Remove Set-Cookie, ETag, or Last-Modified headers from origin responses before caching, so responses that would otherwise be treated as uncacheable can be stored and served from cache.

Benefits

No origin changes required: Fix caching behavior entirely from Cloudflare, even when your origin configuration is locked down or managed by a different team.
Simpler CDN migration: Match caching behavior from other CDN providers without rewriting your origin. Translate cache tag formats and override directives that do not align with Cloudflare's defaults.
Native support, fewer workarounds: Functionality that previously required workarounds is now built into Cache Rules with full Tiered Cache compatibility.
Fine-grained control: Use expressions to match on request and response attributes, then apply precise cache settings per rule. Rules are stackable and composable with existing Cache Rules.

Get started

Configure Cache Response Rules in the Cloudflare dashboard ↗ under Caching > Cache Rules, or via the Rulesets API ↗. For more details, refer to the Cache Rules documentation ↗.

DNS - DNS Analytics for Customer Metadata Boundary set to EU region

Fri, 20 Mar 2026 00:00:00 GMT

DNS Analytics is now available for customers with Customer Metadata Boundary (CMB) set to EU. Query your DNS analytics data while keeping metadata stored in the EU region.

This update includes:

DNS Analytics — Access the same DNS analytics experience for zones in CMB=EU accounts.
EU data residency — Analytics data is stored and queried from the EU region, meeting data localization requirements.
DNS Firewall Analytics — DNS Firewall analytics is now supported for CMB=EU customers.

Availability

Available to customers with the Data Localization Suite who have Customer Metadata Boundary configured for the EU region.

Where to find it

Authoritative DNS: In the Cloudflare dashboard, select your zone and go to the Analytics page.
Go to Analytics ↗
DNS Firewall: In the Cloudflare dashboard, go to the DNS Firewall Analytics page.
Go to Analytics ↗

For more information, refer to DNS Analytics and DNS Firewall Analytics.

Cache - Asynchronous stale-while-revalidate

Thu, 26 Feb 2026 00:00:00 GMT

Cloudflare's stale-while-revalidate support is now fully asynchronous. Previously, the first request for a stale (expired) asset in cache had to wait for an origin response, after which that visitor received a REVALIDATED or EXPIRED status. Now, the first request after the asset expires triggers revalidation in the background and immediately receives stale content with an UPDATING status. All following requests also receive stale content with an UPDATING status until the origin responds, after which subsequent requests receive fresh content with a HIT status.

stale-while-revalidate is a Cache-Control directive set by your origin server that allows Cloudflare to serve an expired cached asset while a fresh copy is fetched from the origin.

Asynchronous revalidation brings:

Lower latency: No visitor is waiting for the origin when the asset is already in cache. Every request is served from cache during revalidation.
Consistent experience: All visitors receive the same cached response during revalidation.
Reduced error exposure: The first request is no longer vulnerable to origin timeouts or errors. All visitors receive a cached response while revalidation happens in the background.

Availability

This change is live for all Free, Pro, and Business zones. Approximately 75% of Enterprise zones have been migrated, with the remaining zones rolling out throughout the quarter.

Get started

To use this feature, make sure your origin includes the stale-while-revalidate directive in the Cache-Control header. Refer to the Cache-Control documentation for details.

Cache - Audit Logs for Cache Purge Events

Tue, 25 Nov 2025 00:00:00 GMT

You can now review detailed audit logs for cache purge events, giving you visibility into what purge requests were sent, what they contained, and by whom. Audit your purge requests via the Dashboard or API for all purge methods:

Purge everything
List of prefixes
List of tags
List of hosts
List of files

Example

The detailed audit payload is visible within the Cloudflare Dashboard (under Manage Account > Audit Logs) and via the API. Below is an example of the Audit Logs v2 payload structure:

{
  "action": {
    "result": "success",
    "type": "create"
  },
  "actor": {
    "id": "1234567890abcdef",
    "email": "user@example.com",
    "type": "user"
  },
  "resource": {
    "product": "purge_cache",
    "request": {
      "files": [
        "https://example.com/images/logo.png",
        "https://example.com/css/styles.css"
      ]
    }
  },
  "zone": {
    "id": "023e105f4ecef8ad9ca31a8372d0c353",
    "name": "example.com"
  }
}

Get started

To get started, refer to the Audit Logs documentation.

Cache - Inspect Cache Keys with Cloudflare Trace

Fri, 07 Nov 2025 00:00:00 GMT

You can now see the exact cache key generated for any request directly in Cloudflare Trace. This visibility helps you troubleshoot cache hits and misses, and verify that your Custom Cache Keys — configured via Cache Rules or Page Rules — are working as intended.

Previously, diagnosing caching behavior required inferring the key from configuration settings. Now, you can confirm that your custom logic for headers, query strings, and device types is correctly applied.

Access Trace via the dashboard or API, either manually for ad-hoc debugging or automated as part of your quality-of-service monitoring.

Example scenario

If you have a Cache Rule that segments content based on a specific cookie (for example, user_region), run a Trace with that cookie present to confirm the user_region value appears in the resulting cache key.

The Trace response includes the cache key in the cache object:

{
  "step_name": "request",
  "type": "cache",
  "matched": true,
  "public_name": "Cache Parameters",
  "cache": {
    "key": {
      "zone_id": "023e105f4ecef8ad9ca31a8372d0c353",
      "scheme": "https",
      "host": "example.com",
      "uri": "/images/hero.jpg"
    },
    "key_string": "023e105f4ecef8ad9ca31a8372d0c353::::https://example.com/images/hero.jpg:::::"
  }
}

Get started

To learn more, refer to the Trace documentation and our guide on Custom Cache Keys.

Load Balancing - Monitor Groups for Advanced Health Checking With Load Balancing

Thu, 16 Oct 2025 00:00:00 GMT

Cloudflare Load Balancing now supports Monitor Groups, a powerful new way to combine multiple health monitors into a single, logical group. This allows you to create sophisticated health checks that more accurately reflect the true availability of your applications by assessing multiple services at once.

With Monitor Groups, you can ensure that all critical components of an application are healthy before sending traffic to an origin pool, enabling smarter failover decisions and greater resilience. This feature is now available via the API for customers with an Enterprise Load Balancing subscription.

What you can do:

Combine Multiple Monitors: Group different health monitors (for example, HTTP, TCP) that check various application components, like a primary API gateway and a specific /login service.
Isolate Monitors for Observation: Mark a monitor as "monitoring only" to receive alerts and data without it affecting a pool's health status or traffic steering. This is perfect for testing new checks or observing non-critical dependencies.
Improve Steering Intelligence: Latency for Dynamic Steering is automatically averaged across all active monitors in a group, providing a more holistic view of an origin's performance.

This enhancement is ideal for complex, multi-service applications where the health of one component depends on another. By aggregating health signals, Monitor Groups provide a more accurate and comprehensive assessment of your application's true status.

For detailed information and API configuration guides, please visit our developer documentation for Monitor Groups.

DNS - DNS Firewall Analytics — now in the Cloudflare dashboard

Tue, 16 Sep 2025 00:00:00 GMT

What's New

Access GraphQL-powered DNS Firewall analytics directly in the Cloudflare dashboard.

Explore Four Interactive Panels

Query summary: Describes trends over time, segmented by dimensions.
Query statistics: Describes totals, cached/uncached queries, and processing/response times.
DNS queries by data center: Describes global view and the top 10 data centers.
Top query statistics: Shows a breakdown by key dimensions, with search and expand options (up to top 100 items).

Additional features:

Apply filters and time ranges once. Changes reflect across all panels.
Filter by dimensions like query name, query type, cluster, data center, protocol (UDP/TCP), IP version, response code/reason, and more.
Access up to 62 days of historical data with flexible intervals.

Availability

Available to all DNS Firewall customers as part of their existing subscription.

Where to Find It

In the Cloudflare dashboard, go to the DNS Firewall page.
Go to Analytics ↗
Refer to the DNS Firewall Analytics to learn more.

Cache - Smart Tiered Cache Fallback to Generic

Fri, 29 Aug 2025 00:00:00 GMT

Smart Tiered Cache now falls back to Generic Tiered Cache when the origin location cannot be determined, improving cache precision for your content.

Previously, when Smart Tiered Cache was unable to select the optimal upper tier (such as when origins are masked by Anycast IPs), latency could be negatively impacted. This fallback now uses Generic Tiered Cache instead, providing better performance and cache efficiency.

How it works

When Smart Tiered Cache falls back to Generic Tiered Cache:

Multiple upper-tiers: Uses all of Cloudflare's global data centers as a network of upper-tiers instead of a single optimal location.
Distributed cache requests: Lower-tier data centers can query any available upper-tier for cached content.
Improved global coverage: Provides better cache hit ratios across geographically distributed visitors.
Automatic fallback: Seamlessly transitions when origin location cannot be determined, such as with Anycast-masked origins.

Benefits

Preserves high performance during fallback: Smart Tiered Cache now maintains strong cache efficiency even when optimal upper tier selection is not possible.
Minimizes latency impact: Automatically uses Generic Tiered Cache topology to keep performance high when origin location cannot be determined.
Seamless experience: No configuration changes or intervention required when fallback occurs.
Improved resilience: Smart Tiered Cache remains effective across diverse origin infrastructure, including Anycast-masked origins.

Get started

This improvement is automatically applied to all zones using Smart Tiered Cache. No action is required on your part.

Secrets Store, AI Gateway, SSL/TLS - Manage and deploy your AI provider keys through Bring Your Own Key (BYOK) with AI Gateway, now powered by Cloudflare Secrets Store

Mon, 25 Aug 2025 11:00:00 GMT

Cloudflare Secrets Store is now integrated with AI Gateway, allowing you to store, manage, and deploy your AI provider keys in a secure and seamless configuration through Bring Your Own Key ↗. Instead of passing your AI provider keys directly in every request header, you can centrally manage each key with Secrets Store and deploy in your gateway configuration using only a reference, rather than passing the value in plain text.

You can now create a secret directly from your AI Gateway in the dashboard ↗ by navigating into your gateway -> Provider Keys -> Add.

You can also create your secret with the newly available ai_gateway scope via wrangler ↗, the Secrets Store dashboard ↗, or the API ↗.

Then, pass the key in the request header using its Secrets Store reference:

curl -X POST https://gateway.ai.cloudflare.com/v1/<ACCOUNT_ID>/my-gateway/anthropic/v1/messages \
 --header 'cf-aig-authorization: ANTHROPIC_KEY_1 \
 --header 'anthropic-version: 2023-06-01' \
 --header 'Content-Type: application/json' \
 --data  '{"model": "claude-3-opus-20240229", "messages": [{"role": "user", "content": "What is Cloudflare?"}]}'

Or, using Javascript:

import Anthropic from '@anthropic-ai/sdk';


const anthropic = new Anthropic({
 apiKey: "ANTHROPIC_KEY_1",
 baseURL: "https://gateway.ai.cloudflare.com/v1/<ACCOUNT_ID>/my-gateway/anthropic",
});


const message = await anthropic.messages.create({
 model: 'claude-3-opus-20240229',
 messages: [{role: "user", content: "What is Cloudflare?"}],
 max_tokens: 1024
});

For more information, check out the blog ↗!

Load Balancing - Steer Traffic by AS Number in Load Balancing Custom Rules

Fri, 15 Aug 2025 00:00:00 GMT

You can now create more granular, network-aware Custom Rules in Cloudflare Load Balancing using the Autonomous System Number (ASN) of an incoming request.

This allows you to steer traffic with greater precision based on the network source of a request. For example, you can route traffic from specific Internet Service Providers (ISPs) or enterprise customers to dedicated infrastructure, optimize performance, or enforce compliance by directing certain networks to preferred data centers.

To get started, create a Custom Rule ↗ in your Load Balancer and select AS Num from the Field dropdown.

Load Balancing - Improvements to Monitoring Using Zone Settings

Wed, 06 Aug 2025 00:00:00 GMT

Cloudflare Load Balancing Monitors support loading and applying settings for a specific zone to monitoring requests to origin endpoints. This feature has been migrated to new infrastructure to improve reliability, performance, and accuracy.

All zone monitors have been tested against the new infrastructure. There should be no change to health monitoring results of currently healthy and active pools. Newly created or re-enabled pools may need validation of their monitor zone settings before being introduced to service, especially regarding correct application of mTLS.

What you can expect:

More reliable application of zone settings to monitoring requests, including
- Authenticated Origin Pulls
- Aegis Egress IP Pools
- Argo Smart Routing
- HTTP/2 to Origin
Improved support and bug fixes for retries, redirects, and proxied origin resolution
Improved performance and reliability of monitoring requests within the Cloudflare network
Unrelated CDN or WAF configuration changes should have no risk of impact to pool health

DNS - Account-level DNS analytics now available via GraphQL Analytics API

Thu, 19 Jun 2025 00:00:00 GMT

Authoritative DNS analytics are now available on the account level via the Cloudflare GraphQL Analytics API.

This allows users to query DNS analytics across multiple zones in their account, by using the accounts filter.

Here is an example to retrieve the most recent DNS queries across all zones in your account that resulted in an NXDOMAIN response over a given time frame. Please replace a30f822fcd7c401984bf85d8f2a5111c with your actual account ID.

GraphQL example for account-level DNS analyticsgraphql

query GetLatestNXDOMAINResponses {
	viewer {
		accounts(filter: { accountTag: "a30f822fcd7c401984bf85d8f2a5111c" }) {
			dnsAnalyticsAdaptive(
				filter: {
					date_geq: "2025-06-16"
					date_leq: "2025-06-18"
					responseCode: "NXDOMAIN"
				}
				limit: 10000
				orderBy: [datetime_DESC]
			) {
				zoneTag
				queryName
				responseCode
				queryType
				datetime
			}
		}
	}
}

To learn more and get started, refer to the DNS Analytics documentation.

DNS - Internal DNS (beta) now manageable in the Cloudflare dashboard

Mon, 16 Jun 2025 00:00:00 GMT

Participating beta testers can now fully configure Internal DNS directly in the Cloudflare dashboard ↗.

Internal DNS enables customers to:

Map internal hostnames to private IPs for services, devices, and applications not exposed to the public Internet
Resolve internal DNS queries securely through Cloudflare Gateway
Use split-horizon DNS to return different responses based on network context
Consolidate internal and public DNS zones within a single management platform

What’s new in this release:

Beta participants can now create and manage internal zones and views in the Cloudflare dashboard

To learn more and get started, refer to the Internal DNS documentation.

DNS - NSEC3 support for DNSSEC

Wed, 11 Jun 2025 00:00:00 GMT

Enterprise customers can now select NSEC3 as method for proof of non-existence on their zones.

What's new:

NSEC3 support for live-signed zones – For both primary and secondary zones that are configured to be live-signed (also known as "on-the-fly signing"), NSEC3 can now be selected as proof of non-existence.
NSEC3 support for pre-signed zones – Secondary zones that are transferred to Cloudflare in a pre-signed setup now also support NSEC3 as proof of non-existence.

For more information and how to enable NSEC3, refer to the NSEC3 documentation.

Load Balancing - New Account-Level Load Balancing UI and Private Load Balancers

Wed, 04 Jun 2025 00:00:00 GMT

We've made two large changes to load balancing:

Redesigned the user interface, now centralized at the account level.
Introduced Private Load Balancers to the UI, enabling you to manage traffic for all of your external and internal applications in a single spot.

This update streamlines how you manage load balancers across multiple zones and extends robust traffic management to your private network infrastructure.

Key Enhancements:

Account-Level UI Consolidation:
- Unified Management: Say goodbye to navigating individual zones for load balancing tasks. You can now view, configure, and monitor all your load balancers across every zone in your account from a single, intuitive interface at the account level.
- Improved Efficiency: This centralized approach provides a more streamlined workflow, making it faster and easier to manage both your public-facing and internal traffic distribution.
Private Network Load Balancing:
- Secure Internal Application Access: Create Private Load Balancers to distribute traffic to applications hosted within your private network, ensuring they are not exposed to the public Internet.
- WARP & Magic WAN Integration: Effortlessly direct internal traffic from users connected via Cloudflare WARP or through your Magic WAN infrastructure to the appropriate internal endpoint pools.
- Enhanced Security for Internal Resources: Combine reliable Load Balancing with Zero Trust access controls to ensure your internal services are both performant and only accessible by verified users.

DNS - Improved onboarding for Shopify merchants

Tue, 03 Jun 2025 00:00:00 GMT

Shopify merchants can now onboard to O2O automatically, without needing to contact support or community members.

What's new:

Automatic enablement – O2O is available for all mutual Cloudflare and Shopify customers.
Branded record display – Merchants see a Shopify logo in DNS records, complete with helpful tooltips.
Checkout protection – Workers and Snippets are blocked from running on the checkout path to reduce risk and improve security.

For more information, refer to the provider guide.

SSL/TLS, Cloudflare for SaaS, Secrets Store - Increased limits for Cloudflare for SaaS and Secrets Store free and Pay-as-you-go plans

Tue, 27 May 2025 11:00:00 GMT

With upgraded limits to all free and paid plans ↗, you can now scale more easily with Cloudflare for SaaS ↗ and Secrets Store ↗.

Cloudflare for SaaS ↗ allows you to extend the benefits of Cloudflare to your customers via their own custom or vanity domains. Now, the limit for custom hostnames ↗ on a Cloudflare for SaaS Pay-as-you-go plan has been raised from 5,000 custom hostnames to 50,000 custom hostnames.

With custom origin server -- previously an enterprise-only feature -- you can route traffic from one or more custom hostnames somewhere other than your default proxy fallback. Custom origin server ↗ is now available to Cloudflare for SaaS customers on Free, Pro, and Business plans.

You can enable custom origin server on a per-custom hostname basis via the API ↗ or the UI:

Currently in beta with a Workers integration ↗, Cloudflare Secrets Store ↗ allows you to store, manage, and deploy account level secrets from a secure, centralized platform your Cloudflare Workers ↗. Now, you can create and deploy 100 secrets per account. Try it out in the dashboard ↗, with Wrangler ↗, or via the API ↗ today.

Load Balancing - UDP and ICMP Monitor Support for Private Load Balancing Endpoints

Tue, 06 May 2025 00:00:00 GMT

Cloudflare Load Balancing now supports UDP (Layer 4) and ICMP (Layer 3) health monitors for private endpoints. This makes it simple to track the health and availability of internal services that don’t respond to HTTP, TCP, or other protocol probes.

What you can do:

Set up ICMP ping monitors to check if your private endpoints are reachable.
Use UDP monitors for lightweight health checks on non-TCP workloads, such as DNS, VoIP, or custom UDP-based services.
Gain better visibility and uptime guarantees for services running behind Private Network Load Balancing, without requiring public IP addresses.

This enhancement is ideal for internal applications that rely on low-level protocols, especially when used in conjunction with Cloudflare Tunnel, WARP, and Magic WAN to create a secure and observable private network.

Learn more about Private Network Load Balancing or view the full list of supported health monitor protocols.

Secrets Store, SSL/TLS - Cloudflare Secrets Store now available in Beta

Wed, 09 Apr 2025 00:00:00 GMT

Cloudflare Secrets Store is available today in Beta. You can now store, manage, and deploy account level secrets from a secure, centralized platform to your Workers.

To spin up your Cloudflare Secrets Store, simply click the new Secrets Store tab in the dashboard ↗ or use this Wrangler command:

wrangler secrets-store store create <name> --remote

The following are supported in the Secrets Store beta:

Secrets Store UI & API: create your store & create, duplicate, update, scope, and delete a secret
Workers UI: bind a new or existing account level secret to a Worker and deploy in code
Wrangler: create your store & create, duplicate, update, scope, and delete a secret
Account Management UI & API: assign Secrets Store permissions roles & view audit logs for actions taken in Secrets Store core platform

For instructions on how to get started, visit our developer documentation.

Cache - Workers Fetch API can override Cache Rules

Fri, 04 Apr 2025 00:00:00 GMT

You can now programmatically override Cache Rules using the cf object in the fetch() command. This feature gives you fine-grained control over caching behavior on a per-request basis, allowing Workers to customize cache settings dynamically based on request properties, user context, or business logic.

How it works

Using the cf object in fetch(), you can override specific Cache Rules settings by:

Setting custom cache options: Pass cache properties in the cf object as the second argument to fetch() to override default Cache Rules.
Dynamic cache control: Apply different caching strategies based on request headers, cookies, or other runtime conditions.
Per-request customization: Bypass or modify Cache Rules for individual requests while maintaining default behavior for others.
Programmatic cache management: Implement complex caching logic that adapts to your application's needs.

What can be configured

Workers can override the following Cache Rules settings through the cf object:

cacheEverything: Treat all content as static and cache all file types beyond the default cached content.
cacheTtl: Set custom time-to-live values in seconds for cached content at the edge, regardless of origin headers.
cacheTtlByStatus: Set different TTLs based on the response status code (for example, { "200-299": 86400, 404: 1, "500-599": 0 }).
cacheKey: Customize cache keys to control which requests are treated as the same for caching purposes (Enterprise only).
cacheTags: Append additional cache tags for targeted cache purging operations.

Benefits

Enhanced flexibility: Customize cache behavior without modifying zone-level Cache Rules.
Dynamic optimization: Adjust caching strategies in real-time based on request context.
Simplified configuration: Reduce the number of Cache Rules needed by handling edge cases programmatically.
Improved performance: Fine-tune cache behavior for specific use cases to maximize hit rates.

Get started

To get started, refer to the Workers Fetch API documentation and the cf object properties documentation.

Cache - All cache purge methods now available for all plans

Thu, 03 Apr 2025 00:00:00 GMT

You can now access all Cloudflare cache purge methods — no matter which plan you’re on. Whether you need to update a single asset or instantly invalidate large portions of your site’s content, you now have the same powerful tools previously reserved for Enterprise customers.

Anyone on Cloudflare can now:

Purge Everything: Clears all cached content associated with a website.
Purge by Prefix: Targets URLs sharing a common prefix.
Purge by Hostname: Invalidates content by specific hostnames.
Purge by URL (single-file purge): Precisely targets individual URLs.
Purge by Tag: Uses Cache-Tag response headers to invalidate grouped assets, offering flexibility for complex cache management scenarios.

Want to learn how each purge method works, when to use them, or what limits apply to your plan? Dive into our purge cache documentation and API reference ↗ for all the details.

SSL/TLS - Upload a certificate bundle with an RSA and ECDSA certificate per custom hostname

Fri, 14 Feb 2025 00:00:00 GMT

Cloudflare has supported both RSA and ECDSA certificates across our platform for a number of years. Both certificates offer the same security, but ECDSA is more performant due to a smaller key size. However, RSA is more widely adopted and ensures compatibility with legacy clients. Instead of choosing between them, you may want both – that way, ECDSA is used when clients support it, but RSA is available if not.

Now, you can upload both an RSA and ECDSA certificate on a custom hostname via the API.

curl -X POST https://api.cloudflare.com/client/v4/zones/$ZONE_ID/custom_hostnames \
    -H 'Content-Type: application/json' \
    -H "X-Auth-Email: $CLOUDFLARE_EMAIL" \
    -H "X-Auth-Key: $CLOUDFLARE_API_KEY" \
    -d '{
    "hostname": "hostname",
    "ssl": {
        "custom_cert_bundle": [
            {
                "custom_certificate": "RSA Cert",
                "custom_key": "RSA Key"
            },
            {
                "custom_certificate": "ECDSA Cert",
                "custom_key": "ECDSA Key"
            }
        ],
        "bundle_method": "force",
        "wildcard": false,
        "settings": {
            "min_tls_version": "1.0"
        }
    }
}’

You can also:

Upload an RSA or ECDSA certificate to a custom hostname with an existing ECDSA or RSA certificate, respectively.
Replace the RSA or ECDSA certificate with a certificate of its same type.
Delete the RSA or ECDSA certificate (if the custom hostname has both an RSA and ECDSA uploaded).

This feature is available for Business and Enterprise customers who have purchased custom certificates.

Cache - Configurable multiplexing HTTP/2 to Origin

Wed, 12 Feb 2025 00:00:00 GMT

You can now configure HTTP/2 multiplexing settings for origin connections on Enterprise plans. This feature allows you to optimize how Cloudflare manages concurrent requests over HTTP/2 connections to your origin servers, improving cache efficiency and reducing connection overhead.

How it works

HTTP/2 multiplexing allows multiple requests to be sent over a single TCP connection. With this configuration option, you can:

Control concurrent streams: Adjust the maximum number of concurrent streams per connection.
Optimize connection reuse: Fine-tune connection pooling behavior for your origin infrastructure.
Reduce connection overhead: Minimize the number of TCP connections required between Cloudflare and your origin.
Improve cache performance: Better connection management can enhance cache fetch efficiency.

Benefits

Customizable performance: Tailor multiplexing settings to your origin's capabilities.
Reduced latency: Fewer connection handshakes improve response times.
Lower origin load: More efficient connection usage reduces server resource consumption.
Enhanced scalability: Better connection management supports higher traffic volumes.

Get started

Enterprise customers can configure HTTP/2 multiplexing settings in the Cloudflare Dashboard ↗ or through our API.

Cache - Fight CSAM More Easily Than Ever

Tue, 04 Feb 2025 00:00:00 GMT

You can now implement our child safety tooling, the CSAM Scanning Tool, more easily. Instead of requiring external reporting credentials, you only need a verified email address for notifications to onboard. This change makes the tool more accessible to a wider range of customers.

How It Works

When enabled, the tool automatically hashes images for enabled websites as they enter the Cloudflare cache ↗. These hashes are then checked against a database of known abusive images.

Potential match detected?
- The content URL is blocked, and
- Cloudflare will notify you about the found matches via the provided email address.

Updated Service-Specific Terms

We have also made updates to our Service-Specific Terms ↗ to reflect these changes.

DNS - Removed unused meta fields from DNS records

Sun, 02 Feb 2025 00:00:00 GMT

Cloudflare is removing five fields from the meta object of DNS records. These fields have been unused for more than a year and are no longer set on new records. This change may take up to four weeks to fully roll out.

The affected fields are:

the auto_added boolean
the managed_by_apps boolean and corresponding apps_install_id
the managed_by_argo_tunnel boolean and corresponding argo_tunnel_id

An example record returned from the API would now look like the following:

Updated API Responsejson

{
	"result": {
		"id": "<ID>",
		"zone_id": "<ZONE_ID>",
		"zone_name": "example.com",
		"name": "www.example.com",
		"type": "A",
		"content": "192.0.2.1",
		"proxiable": true,
		"proxied": false,
		"ttl": 1,
		"locked": false,
		"meta": {
			"auto_added": false,
			"managed_by_apps": false,
			"managed_by_argo_tunnel": false,
			"source": "primary"
		},
		"comment": null,
		"tags": [],
		"created_on": "2025-03-17T20:37:05.368097Z",
		"modified_on": "2025-03-17T20:37:05.368097Z"
	},
	"success": true,
	"errors": [],
	"messages": []
}

For more guidance, refer to Manage DNS records.

Cache - Smart Tiered Cache optimizes Load Balancing Pools

Wed, 08 Jan 2025 00:00:00 GMT

You can now achieve higher cache hit rates and reduce origin load when using Load Balancing with Smart Tiered Cache. Cloudflare automatically selects a single, optimal tiered data center for all origins in your Load Balancing Pool.

How it works

When you use Load Balancing with Smart Tiered Cache, Cloudflare analyzes performance metrics across your pool's origins and automatically selects the optimal Upper Tier data center for the entire pool. This means:

Consistent cache location: All origins in the pool share the same Upper Tier cache.
Higher HIT rates: Requests for the same content hit the cache more frequently.
Reduced origin requests: Fewer requests reach your origin servers.
Improved performance: Faster response times for cache HITs.

Example workflow

Load Balancing Pool: api-pool
├── Origin 1: api-1.example.com
├── Origin 2: api-2.example.com
└── Origin 3: api-3.example.com
    ↓
Selected Upper Tier: [Optimal data center based on pool performance]

Get started

To get started, enable Smart Tiered Cache on your zone and configure your Load Balancing Pool.

Cache - Smart Tiered Cache automatically optimizes R2 caching

Wed, 20 Nov 2024 00:00:00 GMT

You can now reduce latency and lower R2 egress costs automatically when using Smart Tiered Cache with R2. Cloudflare intelligently selects a tiered data center close to your R2 bucket location, creating an efficient caching topology without additional configuration.

How it works

When you enable Smart Tiered Cache for zones using R2 as an origin, Cloudflare automatically:

Identifies your R2 bucket location: Determines the geographical region where your R2 bucket is stored.
Selects an optimal Upper Tier: Chooses a data center close to your bucket as the common Upper Tier cache.
Routes requests efficiently: All cache misses in edge locations route through this Upper Tier before reaching R2.

Benefits

Automatic optimization: No manual configuration required.
Lower egress costs: Fewer requests to R2 reduce egress charges.
Improved hit ratio: Common Upper Tier increases cache efficiency.
Reduced latency: Upper Tier proximity to R2 minimizes fetch times.

Get started

To get started, enable Smart Tiered Cache on your zone using R2 as an origin.

Cache - Stage and test cache configurations safely

Thu, 07 Nov 2024 00:00:00 GMT

You can now stage and test cache configurations before deploying them to production. Versioned environments let you safely validate cache rules, purge operations, and configuration changes without affecting live traffic.

How it works

With versioned environments, you can:

Create staging versions of your cache configuration.
Test cache rules in a non-production environment.
Purge staged content independently from production.
Validate changes before promoting to production.

This capability integrates with Cloudflare's broader versioning system, allowing you to manage cache configurations alongside other zone settings.

Benefits

Risk-free testing: Validate configuration changes without impacting production.
Independent purging: Clear staging cache without affecting live content.
Deployment confidence: Catch issues before they reach end users.
Team collaboration: Multiple team members can work on different versions.

Get started

To get started, refer to the version management documentation.

Cache - Shard cache using custom cache key values

Thu, 07 Nov 2024 00:00:00 GMT

Enterprise customers can now optimize cache hit ratios for content that varies by device, language, or referrer by sharding cache using up to ten values from previously restricted headers with custom cache keys.

How it works

When configuring custom cache keys, you can now include values from these headers to create distinct cache entries:

accept* headers (for example, accept, accept-encoding, accept-language): Serve different cached versions based on content negotiation.
referer header: Cache content differently based on the referring page or site.
user-agent header: Maintain separate caches for different browsers, devices, or bots.

When to use cache sharding

Content varies significantly by device type (mobile vs desktop).
Different language or encoding preferences require distinct responses.
Referrer-specific content optimization is needed.

Example configuration

{
  "cache_key": {
    "custom_key": {
      "header": {
        "include": ["accept-language", "user-agent"],
        "check_presence": ["referer"]
      }
    }
  }
}

This configuration creates separate cache entries based on the accept-language and user-agent headers, while also considering whether the referer header is present.

Get started

To get started, refer to the custom cache keys documentation.

Cache - One-click Cache Rules templates now available

Thu, 05 Sep 2024 00:00:00 GMT

You can now create optimized cache rules instantly with one-click templates, eliminating the complexity of manual rule configuration.

How it works

Navigate to Rules > Templates in your Cloudflare dashboard.
Select a template for your use case.
Click to apply the template with sensible defaults.
Customize as needed for your specific requirements.

Available cache templates

Cache everything: Adjust the cache level for all requests.
Bypass cache for everything: Bypass cache for all requests.
Cache default file extensions: Replicate Page Rules caching behavior by making only default extensions eligible for cache.
Bypass cache on cookie: Bypass cache for requests containing specific cookies.
Set edge cache time: Cache responses with status code between 200 and 599 on the Cloudflare edge.
Set browser cache time: Adjust how long a browser should cache a resource.

Get started

To get started, go to Rules > Templates ↗ in the dashboard. For more information, refer to the Cache Rules documentation.

Cache - Regionalized Generic Tiered Cache for higher hit ratios

Fri, 19 Jul 2024 00:00:00 GMT

You can now achieve higher cache hit ratios with Generic Global Tiered Cache. Regional content hashing routes content consistently to the same upper-tier data centers, eliminating redundant caching and reducing origin load.

How it works

Regional content hashing groups data centers by region and uses consistent hashing to route content to designated upper-tier caches:

Same content always routes to the same upper-tier data center within a region.
Eliminates redundant copies across multiple upper-tier caches.
Increases the likelihood of cache HITs for the same content.

Example

A popular image requested from multiple edge locations in a region:

Before: Cached at 3-4 different upper-tier data centers
After: Cached at 1 designated upper-tier data center
Result: 3-4x fewer cache MISSes, reducing origin load and improving performance

Get started

To get started, enable Generic Global Tiered Cache on your zone.

Cloudflare Web Analytics - Easily Exclude EU Visitors from RUM

Mon, 26 Feb 2024 00:00:00 GMT

You can now easily enable Real User Monitoring (RUM) monitoring for your hostnames, while safely dropping requests from visitors in the European Union to comply with GDPR and CCPA.

Our Web Analytics product has always been centered on giving you insights into your users' experience that you need to provide the best quality experience, without sacrificing user privacy in the process.

To help with that aim, you can now selectively enable RUM monitoring for your hostname and exclude EU visitor data in a single click. If you opt for this option, we will drop all metrics collected by our EU data centers automatically.

You can learn more about what metrics are reported by Web Analytics and how it is collected in the Web Analytics documentation. You can enable Web Analytics on any hostname by going to the Web Analytics ↗ section of the dashboard, selecting "Manage Site" for the hostname you want to monitor, and choosing the appropriate enablement option.

Cloudflare changelogs | Application performance

SSL/TLS - Certificate Transparency Monitoring is now Generally Available

SSL/TLS - Faster and more secure TLS handshakes to your origins, automatically

Gateway, DNS - Internal DNS is now generally available

Why it matters

Cloudflare Web Analytics - Improved reliability for account-wide Web Analytics dashboards

DNS - New DNS Firewall UX with more dashboard settings

What is new

Availability

Where to find it

Cache - Cache multiple versions of a URL with Vary

What changed

Benefits

Availability

Get started

Speed - Cloudflare AMP/SXG is now end of life.

Speed - Cloudflare Fonts error handling and security improvements

SSL/TLS - Post-quantum ML-DSA certificates for Authenticated Origin Pulls and Custom Origin Trust Store

DNS - Account-level DNS records quota

Cache - BYPASS status now returned for uncacheable responses

What to expect in your analytics

Browser cache TTL behavior is preserved

DNS - New DNS records UX is rolling out

What is new

Rollout plan

Share your feedback

Cloudflare Web Analytics - /cdn-cgi/rum endpoint now returns 405 for non-POST requests

Cache - Pingora now powers Cloudflare's cache

What this brings

New features

Behavioral changes

What's next

Speed - Shared dictionaries passthrough now in open beta

What changed

Get started

Cloudflare Web Analytics - Web Analytics adds Navigation Type filtering and reporting

Key benefits

Analyze navigation types in the Cloudflare dashboard

DNS - Account-level enforce DNS-only

Key characteristics

What's affected

Before you enable

Availability

Cache - Cache Response Rules now support zone versioning

What changed

Benefits

Get started

Cache - Smart Tiered Cache optimizes public cloud origins

How it works

Get started

SSL/TLS - Manage mTLS and BYO CA certificates from the Cloudflare dashboard

DNS - Internal DNS - now in open beta

Who can use it?

Cache - Cache Response Rules

What changed

Benefits

Get started

DNS - DNS Analytics for Customer Metadata Boundary set to EU region

Availability

Where to find it

Cache - Asynchronous stale-while-revalidate

Availability

Get started

Cache - Audit Logs for Cache Purge Events

Example

Get started

Cache - Inspect Cache Keys with Cloudflare Trace

Example scenario

Get started

Load Balancing - Monitor Groups for Advanced Health Checking With Load Balancing

What you can do:

DNS - DNS Firewall Analytics — now in the Cloudflare dashboard

What's New

Explore Four Interactive Panels

Availability

Where to Find It

Cache - Smart Tiered Cache Fallback to Generic

How it works

Benefits

Get started