Enforce positive security with Cloudflare Application Profiles

Cloudflare has launched Application Profiles, extending its API Schema Learning and Validation capabilities to web applications to support positive security policies that identify and optionally block HTTP requests deviating from learned, expected structures. The feature analyzes selected operations’ paths, query parameters, headers, cookies, and JSON or form-encoded bodies to learn data types and constraints such as UUID formats, numeric ranges, enumerations, string lengths, and permitted characters, helping reduce exposure to attacks including SQL injection, cross-site scripting, and remote code execution without requiring known attack signatures. Profiles are learned from successful traffic and continuously updated, while validation initially adds metadata rather than automatically blocking requests, allowing customers to investigate violations through Security Analytics and create targeted Security Rules when ready. Cloudflare recommends observation before enforcement because legitimate releases, clients, or uncommon requests may not conform to a profile. The company also plans LLM-powered contextual analysis to identify critical operations and fields, recommend mitigations, and prioritize risks such as reconnaissance, data loss, and business-critical endpoints. The capability is available to API Security customers and is in invitation-only beta for other Enterprise customers, with current limitations including no support for multipart forms, GraphQL, XML, required-parameter enforcement, or blocking solely on new parameters.

Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.