Cloudflare WAF rules can now see when a detection failed

Cloudflare shipped a new field for its WAF on 9 October: cf.appsec.request.failed_detections. It is an array of detection IDs covering content scanning, WAF attack score, attack signature detection, leaked credentials detection, and the AI prompt detections for PII, prompt injection, custom topics and unsafe topics. Until now, if one of these detections errored, a rule built on its result had no way to tell “detection ran and found nothing” apart from “detection did not run at all”.

The field is available in Custom rules and Rate limiting rules at the zone and account level, and in Request Header Transform Rules at the zone level. It returns an empty array when nothing failed, and the underlying detections still need to be included in your plan.

any(cf.appsec.request.failed_detections[*] eq "waf_credential_check")

Why it matters: anyone gating requests on Cloudflare’s leaked credential checks or AI prompt injection detection has been trusting those checks without a way to tell when the check itself broke. This field lets you write a rule that decides explicitly whether a failed detection should fail open or fail closed, instead of finding the gap after an incident.