What Cloudflare shipped in July 2026

Cloudflare announces multiple API deprecations with end-of-life dates through 2026

Cloudflare published a deprecation schedule for six API endpoints and features, including Workers KV legacy routes, Zero Trust network routes, AMP/SXG, legacy Registrar APIs, Zone Settings Batch API, …

Cloudflare adds Email Sending lifecycle event subscriptions via Queues

Cloudflare’s Email Sending service now supports event subscriptions for outbound transactional email lifecycle events, including delivery, deferral, bounce, failure, rejection, complaint, and spam eve…

KV - Deprecate legacy Workers KV namespace API routes

Cloudflare deprecated legacy Workers KV namespace API routes on July 15, 2026, with full removal scheduled for October 15, 2026. Users must migrate from /workers/namespaces/ to /storage/kv/namespaces/…

Email Service, Queues - Subscribe to Email Sending events with Queues

Cloudflare introduced the ability to subscribe to Email Sending events via Queues, enabling users to receive outbound transactional email lifecycle events (e.g., delivered, bounced, failed) on a queue…

A broken DNSSEC rollover took down .AL. Now 1.1.1.1 tells you when validation is bypassed

Cloudflare introduced Extended DNS Error (EDE) code 33 in its 1.1.1.1 resolver to explicitly signal when DNSSEC validation is bypassed due to a Negative Trust Anchor (NTA). This addresses a gap where …

Cloudflare improves Web Analytics dashboard reliability for large accounts

Cloudflare Web Analytics rolled out optimizations to fix dashboard loading failures for accounts tracking over 100 sites. The update reduces timeouts and errors, enabling aggregate views for accounts …

Cloudflare launches Temporary Accounts API for AI agents and platforms

Cloudflare introduced a Temporary Accounts API enabling platforms to create preview accounts via REST API, allowing AI agents and builders to deploy Workers before user sign-up. Users can later claim …

Cloudflare WAF adds rules for Citrix NetScaler and Kemp LoadMaster CVEs

Cloudflare released new WAF managed rules to block exploits for two critical vulnerabilities: CVE-2026-8451 in Citrix NetScaler ADC/Gateway and CVE-2026-8037 in Progress Kemp LoadMaster. Both rules ch…

McpClient

Cloudflare introduced an MCP client capability allowing agents to connect to external MCP servers, enabling standardized interactions with tools, resources, and prompts from services like GitHub, Slac…

Introducing Precursor: detecting agentic behavior with continuous client-side signals

Cloudflare introduced Precursor, a session-based client-side verification system that continuously collects behavioral signals (e.g., mouse movements, keyboard activity) to distinguish human traffic f…

Cloudflare launches Precursor, a one-click behavioral defense against modern bots

Cloudflare introduced Precursor, a next-generation behavioral validation engine for bot management that continuously monitors user sessions to detect evasive bots without disrupting legitimate users. …

Cloudflare R2 Data Catalog adds read-only API tokens for query engines

Cloudflare’s R2 Data Catalog now supports read-only API tokens, allowing query engines like R2 SQL, DuckDB, and PyIceberg to authenticate with least-privilege access. Previously, all operations requir…

Cloudflare Agents SDK adds MCP elicitation support for form and URL requests

Cloudflare’s Agents SDK now lets MCP clients handle elicitation requests from connected servers, enabling structured form input and consent-based URL flows. Developers must register handlers in onStar…

Cloudflare Markdown for Agents now preserves origin headers and content signals

Cloudflare’s Markdown for Agents feature now preserves security headers (HSTS, CSP, CORS, etc.), caching headers (Cache-Control, Expires), and origin-set Content-Signal headers during HTML-to-Markdown…

Cloudflare launches Precursor for continuous behavioral bot detection

Cloudflare introduced Precursor, a continuous behavioral validation engine for bot management that analyzes session-level interactions to distinguish humans from advanced bots with higher precision. I…

Cloudflare rolls out Precursor session-based bot detection for Challenges

Cloudflare introduced Precursor, a client-side JavaScript tool enabling continuous session-based behavioral bot detection within Cloudflare Challenges. It evaluates signals across sessions, re-validat…

R2 Data Catalog, R2 - R2 Data Catalog compaction now optimizes manifest files

Cloudflare’s R2 Data Catalog now automatically optimizes Iceberg manifest files during compaction by rewriting and clustering them by partition. This reduces metadata I/O overhead and speeds up query …

Pricing change detected for Cloudflare

Pricing updated for Cloudflare: - New tier: Free (SSE) ($0/mo — promo: forever) - New tier: Pay-as-you-go (SSE) ($7/mo user) - New tier: Contract (SSE) (Custom pricing) - Removed: Pay-as-you-go tier…

Pricing updated for Cloudflare: - Free: promotion ended (was: forever) - Free: now includes forever

Cloudflare introduces Durable Objects migrations for class management

Cloudflare added migration support for Durable Objects to manage class creation, renaming, deletion, and transfers via Wrangler configuration. Key changes include new `new_sqlite_classes` and `deleted…

Improving Smart Tiered Cache for Public Cloud Regions

Cloudflare launched Smart Tiered Cache for Public Cloud Regions, enabling customers to provide cloud region hints (e.g., aws:us-east-1) for anycast origins hosted on AWS, GCP, Azure, or Oracle Cloud. …

Cloudflare adds plain text output option to Markdown Conversion service

Cloudflare’s Markdown Conversion service now supports a new `output.format` option set to `text`, removing Markdown syntax from converted content. The default remains `markdown`, ensuring backward com…

Cloudflare improves DLP source code detection with whole-file focus and configurable confidence

Cloudflare updated its Data Loss Prevention (DLP) source code detection to analyze whole source code file uploads and downloads instead of partial scans, reducing false positives. The system now requi…

Cloudflare adds API endpoint to create tunnel routes for private networks

Cloudflare introduced a new API endpoint (`POST /accounts/{account_id}/teamnet/routes/network/{ip_network_encoded}`) to route private networks through Cloudflare Tunnels. The endpoint accepts a tunnel…

Cloudflare updates API to modify private network routes in Zero Trust

Cloudflare introduced a PATCH endpoint to update existing private network routes in its Zero Trust suite. The API allows modification of CIDR-based routes via `/accounts/{account_id}/teamnet/routes/ne…

Why we cannot wait for better post-quantum signature algorithms

Cloudflare explains why ML-DSA, a standardized post-quantum signature algorithm, will be the interim solution for quantum-resistant authentication despite its limitations. The company targets full pos…

Cloudflare Workers AI launches with 50+ open-source models and serverless GPUs

Cloudflare launched Workers AI, a serverless platform enabling developers to run AI models on GPUs across Cloudflare’s global network. The service offers 50+ open-source models, pay-per-use pricing, a…

Cloudflare launches Workflows for durable multi-step applications on Workers

Cloudflare introduced Workflows, a feature enabling durable, multi-step applications on its Cloudflare Workers platform. Workflows allow automatic retries, state persistence, and integration with exte…

Cloudflare blocks new key-value Durable Object namespaces, mandates SQLite

Cloudflare will no longer allow new key-value backed Durable Object namespaces for accounts without existing ones, requiring new namespaces to use the SQLite storage backend instead. The change enforc…

Cloudflare Wrangler adds npm dependency metadata to Worker uploads

Wrangler now automatically collects npm package dependency details—name, version range, and installed version—during Worker deployments and uploads, embedding this metadata in API payloads for supply …

Cloudflare retires CIDR-encoded route endpoints and connections field on October 5, 2026

Cloudflare will remove CIDR-encoded route endpoints and the connections field from Tunnel and Mesh APIs on October 5, 2026. Route management will shift to route_id-based endpoints, and connection deta…

Cloudflare refreshes DNS Firewall UX with dashboard-first cluster settings

Cloudflare introduced a redesigned DNS Firewall page in its dashboard, moving previously API-only cluster settings like attack mitigation and rate limiting into the UI. The update includes a revamped …

Cloudflare Workflows adds dynamic delay functions for retries

Cloudflare Workflows now supports dynamic delay functions in step retries, allowing developers to adjust retry timing based on failure type and error context. Previously limited to fixed delays or bac…

Cloudflare Workers AI adds toMarkdown utility for document conversion

Cloudflare introduced the `toMarkdown` method in Workers AI, enabling developers to convert documents in multiple formats to Markdown via bindings or REST APIs. The feature supports structured input f…

Cloudflare launches moondream3.1-9B-A2B vision-language model on Workers AI

Cloudflare introduced moondream3.1-9B-A2B, a 9B mixture-of-experts vision-language model with 2B active parameters, optimized for visual reasoning tasks like object detection, pointing, OCR, and struc…

Cloudflare adds Images binding to Workers for in-line image optimization

Cloudflare introduced an Images binding for Workers that allows direct image optimization, resizing, and manipulation using raw image bytes from any source (Images, R2, fetch responses, or request bod…

Workers - Cloudflare Drop

Cloudflare introduced 'Drop,' a feature allowing users to deploy static sites (HTML, CSS, JS, images) without a Cloudflare account. Users upload a folder or zip file to receive a temporary live previe…

Cloudflare launches Meerkat: a global consensus service for strongly consistent key-value stores

Cloudflare introduced Meerkat, an experimental global consensus service powered by the QuePaxa algorithm, designed to provide strong consistency and fault tolerance for control-plane state management.…

Cloudflare IPsec adds quantum downgrade protection in beta

Cloudflare IPsec now supports the IKE_SA_INIT_FULL_TRANSCRIPT_AUTH extension to prevent quantum downgrade attacks on IKEv2 tunnels. The feature is available in beta for Cloudflare WAN and Magic Transi…

Cloudflare launches REST API for AI Search document management

Cloudflare introduced a new REST API enabling users to upload, list, retrieve, delete, and download documents within AI Search instances. The API requires an API token with specific permissions and op…

Cloudflare and OpenAI launch research pilot to improve AI search with network signals

Cloudflare and OpenAI announced a research pilot combining Cloudflare’s global network insights with OpenAI’s search capabilities to enhance AI-driven content discovery and indexing. The initiative ai…

Cloudflare AI Search adds key-based item lookup

Cloudflare’s AI Search list items endpoint now supports a `key` query parameter to retrieve a single item by its exact object key, improving efficiency for developers. The feature complements existing…

Cloudflare adds GIF and BMP support to Workers AI toMarkdown and AI Search

Cloudflare expanded its Workers AI toMarkdown feature to support GIF and BMP image files, enabling automatic conversion to searchable text for AI Search indexing. The update processes images through t…

Cloudflare adds Moondream 3.1 vision language model to Workers AI

Cloudflare integrated Moondream 3.1, a 9B-parameter vision language model with 2B active parameters, into its Workers AI platform. The model delivers frontier-level visual reasoning with sub-second la…

Cloudflare adds in-dashboard R2 SQL query editor for Data Catalog

Cloudflare now lets users run R2 SQL queries against Apache Iceberg tables in the R2 Data Catalog directly from the Cloudflare dashboard, eliminating the need for local CLI tools. The built-in SQL edi…

Cloudflare launches /accessibilityTree endpoint for Browser Run

Cloudflare introduced a new /accessibilityTree endpoint in its Browser Run service, enabling users to capture a webpage's accessibility tree after JavaScript execution. The endpoint returns structured…

Cloudflare proudly joins the UK government's Cyber Resilience Pledge

Cloudflare announced its participation in the UK government's voluntary Cyber Resilience Pledge, committing to board-level accountability, supply chain security, and foundational cybersecurity governa…

Cloudflare adds WebSocket Analytics Logpush dataset for Enterprise customers

Cloudflare introduced a new WebSocket Analytics Logpush dataset for Enterprise customers, enabling per-connection telemetry including close reasons, sources, and session metadata. Logs are emitted on …

Cloudflare Workflows adds per-step billing starting August 10, 2026

Cloudflare Workflows will introduce per-step billing alongside existing storage billing, effective no earlier than August 10, 2026. Paid plans include 500,000 steps per month and 1 GB-month of storage…

Cloudflare adds /accessibilityTree endpoint to Browser Run

Cloudflare introduced a new `/accessibilityTree` endpoint for Browser Run, enabling direct access to the semantic structure of rendered webpages via the browser's accessibility tree. This simplifies A…

Cloudflare releases GA version of Windows Cloudflare One Client with SSO fix

Cloudflare launched the general availability (GA) version 2026.6.850.0 of its Windows Cloudflare One Client, addressing a Windows authentication issue in the embedded WebView2 browser. The fix enables…

Cloudflare adds file transfer controls for browser-based RDP (beta)

Cloudflare introduced beta file transfer controls for its browser-based RDP service, allowing administrators to restrict uploads, downloads, or both between local machines and remote Windows servers. …

R2 - R2 Data Catalog warns before you delete data manually

Cloudflare’s R2 Data Catalog now warns users before manually deleting data in buckets where the catalog is enabled. The R2 dashboard and Wrangler CLI display alerts to prevent catalog corruption from …

Cloudflare adds Browser Isolation support for authorization proxy endpoints

Cloudflare expanded Browser Isolation to work with authorization proxy endpoints in Cloudflare One, enabling identity-based HTTP Isolate policies for PAC file-proxied traffic. Previously, only source …

Cloudflare One Appliance, Cloudflare One, Cloudflare WAN - Self-serve registration of Cloudflare One Virtual Appliance in the dashboard

Cloudflare introduced self-serve registration for its Cloudflare One Virtual Appliance in the dashboard, allowing users to generate license keys without contacting their account team. This update comp…

Cloudflare launches Workers Cache for server-rendered apps

Cloudflare introduced Workers Cache, a regionally tiered cache that sits directly in front of Worker entrypoints, configured via standard HTTP headers. The feature eliminates redundant Worker invocati…

Cloudflare shifts TypeScript support to Wrangler-generated types for Workers

Cloudflare now recommends generating TypeScript types for Workers via the `wrangler types` command instead of relying on the `@cloudflare/workers-types` package. The new approach dynamically generates…

Cloudflare Workers types v5 drops dated entrypoints, simplifies runtime types

Cloudflare released @cloudflare/workers-types v5, removing dated compatibility entrypoints and consolidating runtime types into two entrypoints: the latest stable and experimental APIs. Users must now…

Cloudflare AI Search expands data source options and supported file types

Cloudflare AI Search now supports three data source types: built-in storage, website domains, and Cloudflare R2 buckets. It also broadens file type support to include 20+ formats like PDFs, Office doc…

Cloudflare Cache Rules now support Vary response headers for multi-version caching

Cloudflare’s Cache Rules now honor the origin’s Vary response header, enabling the same URL to cache multiple versions differentiated by request headers like Accept-Language or Accept. Users can choos…

Cloudflare adds hostname routing to Cloudflare Mesh

Cloudflare introduced hostname routing for its Cloudflare Mesh nodes, allowing traffic to be routed by hostname (e.g., wiki.internal.local) instead of IP addresses. This simplifies internal applicatio…

Cloudflare adds Wrangler auth profiles for multi-account management

Cloudflare’s Wrangler CLI now supports named auth profiles to switch between Cloudflare accounts per project without re-authenticating. Profiles are directory-scoped and can be activated via configura…

Cloudflare Workers adds authentication profiles to Wrangler CLI

Cloudflare introduced authentication profiles in Wrangler, allowing developers to maintain separate OAuth logins and switch between Cloudflare accounts per directory without re-authenticating. Profile…

Cloudflare adds Wrangler CLI commands to manage AI Search sync jobs

Cloudflare introduced new Wrangler CLI commands to trigger, monitor, and manage sync jobs for AI Search instances connected to data sources. Users can now automate index refreshes via CI/CD pipelines …

Cloudflare updates Logpush datasets with new fields for Gateway DNS, HTTP, and HTTP requests

Cloudflare updated multiple Logpush datasets by adding new fields: `AppliedMaxTTL` and `UpstreamRecordTTLs` for Gateway DNS, `Warnings` for Gateway HTTP, and `CacheLockWaitedMs` for HTTP requests. The…

Cloudflare adds infrastructure application support for granular server access control

Cloudflare expanded its Zero Trust platform with infrastructure application support, enabling granular control over server, cluster, or database access via SSH. Users can now configure authentication,…

Cloudflare Containers now supports Docker Hub, Amazon ECR, and Google Artifact Registry images

Cloudflare’s Containers platform now allows developers to push custom images during deployment or use pre-built images from Cloudflare’s registry, Docker Hub, Amazon ECR, and Google Artifact Registry.…

Cloudflare One Client - Cloudflare One Client for Linux (version 2026.6.836.0)

Cloudflare launched GA version 2026.6.836.0 of its Linux Cloudflare One Client, addressing a dependency issue in RPM-based distributions where incorrect builds were served. The fix ensures correct pac…

Cloudflare expands Zero Trust Lists with CSV upload and Terraform support

Cloudflare introduced reusable lists in Zero Trust to centralize management of URLs, hostnames, IP addresses, and other entries for Gateway and Access policies. Users can now upload lists via CSV or c…

Cloudflare enhances Bot Management with AI bot blocking and ML auto-updates

Cloudflare updated its Bot Management Enterprise feature to include AI bot blocking, auto-updates for machine learning models, and granular bot scoring (1-99) with customizable rules. Customers can no…

Content Independence Day, one year on: building the business model for the agentic Internet

Cloudflare declared 'Content Independence Day' a year ago, blocking AI training crawlers by default for new domains to restore transparency and control for publishers. Now, they report that over 50% o…

Making AI search smarter

Cloudflare introduced a research program to make AI search smarter by using network signals to surface fresher, higher-quality content and reduce unnecessary crawling. It also unveiled a Pay Per Use m…

Announcing the Monetization Gateway: charge for any resource behind Cloudflare via x402

Cloudflare introduced the Monetization Gateway, enabling customers to charge for any resource behind Cloudflare (web pages, APIs, datasets, MCP tools) using the open x402 protocol. Payments settle in …

Your site, your rules: new AI traffic options for all customers

Cloudflare introduced a refined AI bot classification system (Search, Agent, Training) and new default blocking rules for ad pages starting September 15, 2026. All customers now have granular controls…

Pricing updated for Cloudflare: - Free: new promotion — forever

Unmasking the crawls with Attribution Business Insights

Cloudflare introduced Attribution Business Insights, a new dashboard for its Bot Management customers to analyze AI bot traffic and its impact on website economics. The tool provides crawl-to-referral…

Pricing updated for Cloudflare: - Plan features or structure changed

Cloudflare Images binding switches to unique-transformation billing

Cloudflare’s Images binding now bills per unique transformation, counting repeat requests for the same image and parameters only once per month. Calls to .info() are now free, aligning with URL-based …

Cloudflare fixes URL fragment encoding in Access for SPAs

Cloudflare resolved an issue where Access over-encoded URL fragment characters during post-login redirects, breaking SPA navigation. The fix preserves characters like /, ?, =, &, and ; in fragment-bas…

Cloudflare introduces granular AI traffic controls for Search, Agent, and Training bots

Cloudflare now lets all customers, including Free plan users, manage AI crawlers by behavior—Search, Agent, and Training—rather than a single toggle. Starting September 15, 2026, new domains will defa…

Vectorize - Reduced end-to-end latency for vector changes

Cloudflare reduced end-to-end latency for vector changes in Vectorize by improving WAL throughput, cutting median latency from 2 minutes to under 30 seconds and p99 latency from 5 minutes to under 2 m…

Cloudflare WAF release adds CVE-2026-39813 coverage and disables fake bot rule

Cloudflare’s July 1, 2026 WAF release introduces a new rule blocking path traversal attacks targeting Fortinet FortiSandbox (CVE-2026-39813) and disables the Anomaly:Header:User-Agent - Fake Bing or M…

Cloudflare adds BotBase and Attribution Business Insights to Enterprise Bot Management

Cloudflare introduced BotBase, a searchable directory of all tracked bots with behavioral classifications, and Attribution Business Insights, a dashboard showing crawl-to-referral ratios for AI traffi…

Cloudflare adds hardware-backed MFA for SSH via YubiKey PIV keys

Cloudflare’s Access for Infrastructure now supports independent MFA for SSH using YubiKey PIV keys, adding hardware-backed second-factor authentication. Admins can enforce PIV key requirements per app…

Cloudflare launches tools to shape the agentic internet with content control and monetization

Cloudflare introduced new classifications, enhanced analytics, and commercial partnerships to help site owners and AI companies collaborate in the agentic internet. Default settings will block AI trai…

Cloudflare Containers now support Google Artifact Registry images

Cloudflare Containers now allow direct use of private Google Artifact Registry images without pushing to Cloudflare Registry first. Users configure credentials via service account email and JSON key, …