Cloudflare launches Application Profiles for positive security

Cloudflare has rolled out a new security feature designed to enforce positive security policies by learning the expected structure of HTTP requests. Application Profiles, currently in closed beta for Enterprise customers, allows organizations to block traffic that deviates from observed patterns without requiring predefined attack signatures. The tool extends Cloudflare’s existing Schema Learning and Validation capabilities from APIs to web applications, offering an automated approach to reducing attack surfaces amid rising concerns about AI-generated threats.

How the tool works

Application Profiles analyzes live traffic to determine the expected structure of HTTP requests, including path variables, query parameters, headers, cookies, and request bodies. The system learns data types (such as integers, strings, UUIDs, and enums) and constraints like numeric ranges, string lengths, and character classes. Once a profile is established, Cloudflare flags requests that do not conform to the learned schema, adding metadata to indicate violations. Customers can review these violations in Security Analytics before deciding whether to enforce blocking rules.

The learning process requires a minimum of 1,000 successful requests (2xx responses) over seven days to identify fields and 10,000 requests to establish data boundaries. Profiles update weekly to reflect changes in application traffic, though customers can manually export and pin schemas if needed. The tool supports JSON and form-encoded request bodies but does not currently handle multipart forms, GraphQL, or XML. Cloudflare also plans to introduce on-demand learning and the ability to exclude automated traffic from profile generation.

Practical applications and limitations

Application Profiles can identify a range of deviations, such as malformed UUIDs, unexpected characters in query parameters, or values outside learned ranges. For example, if a search field expects alphanumeric input, the tool can block requests containing special characters, mitigating common attack vectors like SQL injection or cross-site scripting. However, non-conforming requests are not inherently malicious—new application releases, unusual but valid requests, or changes in client behavior can also trigger violations. Cloudflare recommends starting in observation mode to assess the impact before enabling enforcement.

The tool provides granular control over enforcement. Customers can create Security Rules to block non-conforming requests at the application, path, or field level. Metadata fields indicate where violations occurred (e.g., query parameters, headers) and whether undeclared parameters were detected. This allows teams to tailor rules to specific operations or exclude certain fields from enforcement. For instance, a rule could block requests where the product_id query parameter violates the learned schema while allowing other deviations.

Operational challenges and future enhancements

Deploying positive security at scale presents operational complexities, particularly for large applications with thousands of operations and fields. Cloudflare acknowledges this challenge and is developing tools to help prioritize enforcement. Upcoming features include LLM-powered insights to contextualize learned profiles, identifying critical fields (such as those linked to authentication or account management) and recommending targeted mitigations. For example, the system could highlight fields like clientId or account_number and suggest rate-limiting rules to defend against brute-force attacks.

Cloudflare also plans to introduce metrics to rank operations by risk, such as unusual data transfer trends, reconnaissance activity, or business criticality. These metrics will help security teams focus on high-priority areas first. Additionally, the company is exploring the use of Application Profiles to learn other characteristics of expected traffic, such as autonomous system numbers (ASNs) or JA4 fingerprints, further refining the definition of "good" traffic.

Availability and next steps

Application Profiles is available now to customers with Cloudflare’s API Security offering. A closed beta is open to invited Enterprise customers without API Security, allowing them to test the feature on production web applications. Participants can provide feedback on profile accuracy, analytics, and enforcement controls. Access is by invitation only and does not guarantee future availability. Interested customers are advised to contact their account teams for details.