The Configure AI bot policies setting is now named AI Crawler and Agent access policies. Personal agents act on a person's behalf, fetching information or browsing in response to a request. The ...

Account Abuse Protection (in early access) now shows which recognized AI assistants make login and sign up requests, and ...

Cloudflare Radar now includes Zero Wire, a hub of briefings on critical vulnerabilities and threats, with confirmed facts, open questions, remediation steps, and related Cloudflare data.

A Verified bot is a bot or agent that Cloudflare has confirmed is transparent about who it is and what it does: it represents itself honestly and does not abuse the access that honesty earns. Examples ...

AI Search billing now begins on December 1, 2026 instead of November 1, 2026. New instances sync every 24 hours by default.

You can now assign key-value tags to Access service tokens and use those tags to organize credentials or control application access. Each token supports up to five tags, such as environment: ...

JavaScript Workers with compatibility dates on or after November 17, 2026 will use URL-based module resolution and import.meta by default.

Keyless SSL supports TLS 1.3 for ECDSA certificates. When TLS 1.3 is enabled on your zone, visitors connecting to a hostname ...

This release introduces updates to the underlying rule expressions for PHP out-of-memory (OOM) vulnerabilities CVE-2026-109618, CVE-2026-109619 and CVE-2026-115560. The improvements are iterative ...

Active Durable Objects get up to 5 minutes to finish work before adopting new code. You can configure the delay or apply ...

The new DNS records experience announced in May is now the default for all users on all plans, including Enterprise. The ...

Cloudflare WAN traffic can now use a Gateway processing region with Regional Services. HTTPS traffic enters a Cloudflare data ...