Cloudflare WAF: checks after the October 21 announcements
Emergency WAF announcements and a short landing-page checklist when the source descriptions disagree.
On October 21, 2026, Cloudflare’s official changelog listed emergency announcements for its Managed and Free Rulesets concerning anomalous requests. This dates the release announcements; it does not establish when changes reached an individual site.
Update after a repeat check on October 21: the Managed description no longer splits rules into Block and Log, but its stated rule count still differs from the number of table rows. The Free announcement also retains inconsistencies between its description and table. We therefore omit an exact rule count and do not infer the actions applied to your site from the announcement; the responsible operator must verify them in the account in use.
Our checklist for landing-page owners
- Assign a technical owner. Give them the announcement date, site address and ruleset actually used; ask them to check applied actions and exceptions.
- Record the inspection time, scope and result. Keep account observations separate from the announcement; a published release is not confirmation of your protection.
- Follow the normal visitor journey through the landing page and an authorized form test that creates no payable conversion. Record expected and observed outcomes.
- If something fails, compare its timestamp with available logs. Establish the cause before blaming WAF, and avoid disabling all protection to restore one step.
- Tell partners only what is confirmed: checked, an error found, or clarification needed. Keep lead contents and secret parameters out of the update.
For example, an advertiser notices a form failure after the announcement. Timing alone does not establish causation: a specialist investigates the request before the publisher receives a confirmed landing-page status. This is our editorial workflow, not Cloudflare’s instruction or a report of an AffiliateCore incident.
Sources checked on October 21, 2026. The cover is an illustration, not the Cloudflare interface.
Cloudflare Free Ruleset — 21.10.2026
Clarification dated October 22, 2026
In today’s check, both official announcements—Managed and Free—state seven rules each; each table has seven rows, all with the Block action. The discrepancies recorded above on October 21 are no longer observable. The October 21 note remains as a record of that check, not a description of the sources as they now appear. The exact time the sources changed is unknown. This observation concerns public announcements; it does not establish account configuration, exceptions or when rules were applied. The technical owner must still verify those details. The original publication date remains October 21.