Cloudflare has introduced programmable logic into its secure web gateway, enabling users to execute custom code directly within security policy evaluation paths. The update targets long-standing limitations in traditional gateway models, where rigid rule sets force security teams to deploy additional infrastructure for tasks like header injection, real-time notifications, or dynamic response pages.
What changed
The company released a new Gateway action called Forward, available in public beta, which routes matched HTTP traffic to a Cloudflare Worker for inline transformation. A second feature, Custom Functions, will follow later in 2026 and will allow Workers to return typed values for use in rule conditions. Both capabilities are accessible across all Zero Trust plan tiers.
Forward acts as middleware, receiving full request and response objects. Users can modify headers, call external APIs, or log data without maintaining separate proxy infrastructure. Custom Functions, by contrast, operate as selectors within policy conditions, returning values like strings or booleans that Gateway evaluates alongside built-in attributes such as source IP or content category.
Background: Secure web gateways traditionally enforce security policies through static rule sets that trigger terminal actions—allow, block, isolate, or log. These systems struggle with tasks requiring dynamic logic, such as parsing JSON Web Tokens or serving customized warning pages, forcing teams to deploy and manage additional infrastructure like NGINX proxies or SIEM pipelines.
Why the integration matters
Cloudflare’s approach eliminates the need for separate compute resources by running Workers and Gateway on the same physical machines in its global network. This co-location removes network hops, reducing latency to the execution time of the Worker code itself. Other SASE providers without integrated compute platforms require users to deploy automation in external clouds, introducing round-trip delays and management overhead.
The integration also extends to Data Loss Prevention (DLP). Custom validation functions can now dispatch Workers to verify detected data against external sources, such as checking whether a GitHub token is active before enforcing a policy. This addresses a core limitation of pattern-based detection, which cannot distinguish between sensitive data and false positives without external validation.
Practical applications
Security teams can now build features that were previously impractical within gateway constraints:
- Interstitial pages: Workers intercept requests to sensitive destinations, prompt users for justification, and log responses to Cloudflare D1 or external databases.
- Real-time alerts: A Worker bound to a DLP rule sends Slack or PagerDuty notifications with user identity, rule name, and destination URL.
- Dynamic header injection: Custom Functions parse JWTs to extract role data, which Gateway then uses to set upstream headers without additional proxies.
- File inspection: Workers route files to third-party sandboxing services or store them in Cloudflare R2 for later analysis.
For professionals: Teams maintaining custom security logic can replace standalone proxy pools or log pipelines with Workers, reducing operational overhead. The Forward action and Custom Functions are billed as standard Worker requests, with free tier limits on execution time and daily volume to consider at scale.
Limitations and roadmap
Custom Functions remain in development, with general availability expected before the end of 2026. Cloudflare plans to expand programmable entry points to other Cloudflare One services, including Email Security. Enterprise customers can request strategy sessions or early access to the Custom Functions beta through their account teams.
Companies mentioned
Automated pipeline · Cloud & Infrastructure
Synthesized from 1 industry feed on 15 Oct 2026. Passed independent editor verification (score 95/100) before publication. Style guide v1.4.
Sources
Decision trail
- Checking for duplicates — Deduped batch of 1 candidates
- Checking for duplicates — Failed no verdict returned
- Checking for duplicates — Deduped batch of 2 candidates
- Checking for duplicates — New story No recent or in-pipeline article covers Cloudflare Gateway's secure web gateway integration with Workers.
- Writing the article — Draft created article_id=704 slug=cloudflare-adds-programmable-logic-to-secure-web-gateway
-
Editor review — Approved
- Score: 95/100
- Style compliance: The draft exceeds the 700-word limit (approximately 720 words). While this is not material, it slightly deviates from the 300-700 word guideline.
- No copied phrasing: The phrase 'arbitrary logic that you wrote for your specific environment — inline in the policy evaluation path' closely mirrors the source text. While the idea is paraphrased, the phrasing is too similar and should be restructured further.
- Style compliance: The Background block is well-sourced but slightly longer than the recommended 2-4 sentences. It could be tightened without losing clarity.
- Generating reader Q&A — Generated 4 items
- Assigning hero image — Reused library image reused image #54
- Linking related stories — Linked 5 relations from 348 candidates
- Publishing — Published cloudflare-adds-programmable-logic-to-secure-web-gateway
- Mastodon — Posted https://mstdn.social/@hostingpaper/117446671193121319
Discussion · coming soon
Be the first to join the thread when community discussion launches.