--- url: "https://www.xcademia.com/news/cloudflare-makes-security-gateway-and-data-loss-prevention-programmable-with-workers" title: Cloudflare Makes Security Gateway and Data Loss Prevention Programmable with Workers description: "Cloudflare adds programmable Workers to Gateway and DLP, enabling custom security policies, traffic processing and sensitive data validation." publishedAt: "2026-10-16T11:21:04.641+00:00" updatedAt: "2026-10-22T07:01:20.212865+00:00" type: news category: cybersecurity source_name: Cloudflare Blog source_url: "https://blog.cloudflare.com/programmable-gateway-dlp/" tags: - "#Cloudflare" - "#DataLossPrevention" - "#CloudSecurity" - "#ZeroTrust" - "#SecureWebGateway" - "#CloudflareWorkers" - "#SASE" - "#EnterpriseSecurity" --- # Cloudflare Makes Security Gateway and Data Loss Prevention Programmable with Workers > Cloudflare is extending Gateway and Data Loss Prevention with custom logic powered by Cloudflare Workers, enabling organisations to transform traffic, validate sensitive data and build security policies around their own requirements. Source: **Cloudflare Blog** · 16 October 2026 **C**loudflare is extending its security platform with programmable capabilities that allow organisations to run custom code during security policy evaluation and data loss prevention checks. Announced on 15 October 2026, the update integrates Cloudflare Workers with Cloudflare Gateway and Data Loss Prevention (DLP), giving security teams more control over how web traffic is processed and how sensitive data detections are validated. The announcement introduces two new Gateway capabilities: the Forward action, which routes selected HTTP requests through a Worker for custom processing, and Custom Functions, which extend policy evaluation with organisation-specific logic. Cloudflare also announced custom validation functions for DLP, allowing businesses to verify detected information against their own sources of truth before applying a security decision. Cloudflare says the Forward action is available in public beta, while Gateway Custom Functions are expected before the end of 2026. DLP custom validation functions are available starting with the announcement. ## Why Cloudflare Is Making Security Gateways Programmable Traditional secure web gateways generally evaluate traffic against configured rules and apply predefined actions such as allowing, blocking, isolating or logging a request. This approach works for common security requirements, but it can become restrictive when organisations need more specialised behaviour. For example, a company may need to add HTTP headers based on a user's identity claims, request additional justification before allowing access to a sensitive destination, or notify a security team immediately when a data loss prevention rule is triggered. These requirements can force organisations to build separate proxy servers, connect several automation systems or route events through external logging and notification pipelines. Such arrangements introduce additional infrastructure to maintain and can create operational complexity. Cloudflare's approach is to let customers execute their own code within the existing security workflow. By integrating Workers with Gateway and DLP, the company aims to make custom processing part of the security decision itself rather than requiring every use case to depend on a separately maintained service. The change reflects a broader industry shift towards programmable security controls, where organisations can adapt enforcement logic to their own applications, identities, data and business requirements. ### ![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1792149602662-info1--125-.webp) ## 1. Cloudflare Gateway Gains Two Programmable Entry Points The Gateway update introduces two ways to integrate custom Worker code into security policies. Each serves a different purpose. ### Forward action: Custom processing of HTTP traffic The Forward action routes HTTP requests matching a configured policy to a designated Cloudflare Worker. The Worker operates as inline middleware, receiving the request headers and body and potentially modifying them before forwarding the request to its destination. The Worker can also process the response before returning it to the user. Alternatively, it can perform an asynchronous task, such as sending a notification or writing an event to a storage system, while allowing the original traffic to continue. Gateway continues to handle connection management, TLS termination and re-encryption, certificate management, and HTTP version negotiation. The Worker focuses on the custom processing logic. This separation allows developers to extend traffic handling without having to host and maintain a conventional HTTP proxy for every specialised requirement. ### Custom Functions: Organisation-specific policy evaluation Custom Functions provide a different extension point. Instead of modifying an HTTP request, a Worker evaluates contextual information and returns a typed value, such as a string, number or Boolean, which Gateway can use in a policy condition. The available context can include source IP address, destination, user identity, device posture and HTTP headers, depending on the policy phase. For example, a Worker could extract a user's role from an identity token and return that role as a policy selector. An administrator could then use the returned value in a rule that determines whether a particular request should be allowed. Custom Functions can also support network policies involving Layer 4 traffic, using connection and identity metadata rather than relying on the full HTTP request. The distinction is important: Forward is designed for traffic processing and transformation, while Custom Functions extend the information and logic available when Gateway evaluates a policy. ### ![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1792149622948-info2--126-.webp) ## 2. Practical Security Use Cases for Programmable Gateway Cloudflare outlines several scenarios in which organisations could use the new capabilities to build controls around their existing environments. ### Access requests with user justification Organisations sometimes need more context before allowing access to sensitive websites or applications. A Worker can intercept a request and present an intermediate page asking the user to explain why access is required. The implementation can also record the user's identity and justification for auditing. Cloudflare describes using its key-value storage and database services to maintain session information and create an audit trail. This approach gives security teams a way to customise access workflows around internal policies rather than relying exclusively on fixed gateway responses. ### Dynamic HTTP header injection Applications often require identity or role information to be passed through HTTP headers. A custom function can extract a user's role or group membership from an authorisation token and expose it as a Gateway policy selector. A matching rule can then apply the appropriate header to the upstream request. Cloudflare presents this as an alternative to operating a separate NGINX proxy pool solely to perform header transformations. Organisations would still need to implement and test their own identity parsing and policy logic. ### File inspection and logging A Worker can be configured to handle selected file downloads by sending a file to a third-party sandboxing service for analysis. Alternatively, it can write a copy to Cloudflare R2 for later inspection. The exact behaviour depends on the Worker implementation and the organisation's policy requirements. File handling, storage and external integrations therefore remain implementation decisions rather than automatic outcomes of enabling the feature. ### Real-time security notifications When a DLP profile matches traffic, a Worker associated with a Forward policy can send an alert to a supported notification endpoint, such as Slack or PagerDuty. An alert can include contextual details such as the user's email address, the matching policy rule and the destination URL. This provides an alternative to building a separate chain of logging, security information and event management (SIEM), and messaging integrations for every notification use case. ### Complex risk evaluation Some organisations maintain internal risk scores or complex relationships between users, groups and access conditions. These may be difficult to express using a conventional policy builder. A Custom Function can retrieve or calculate the relevant information and return a value that Gateway can evaluate as part of a policy. For security teams, this creates an opportunity to incorporate existing internal decision systems into gateway enforcement without necessarily moving all their reference data into the security vendor's platform. ## 3. DLP Custom Validation Adds Context to Sensitive Data Detection The DLP update addresses a separate challenge: detecting a sensitive-looking value does not always establish whether that value is active, relevant or being misused. Traditional DLP systems commonly identify information using predefined patterns, regular expressions, word lists and contextual signals. These methods can detect data resembling a secret, credential or other sensitive value, but a pattern match alone may not establish whether the specific instance presents a real risk. Cloudflare's custom validation functions allow organisations to add their own validation logic through a Cloudflare Worker. The logic can consult an external service or another authorised source of information before the DLP system makes its enforcement decision. ### Example: Verifying whether a detected secret is active Consider a DLP profile configured to detect GitHub credentials in outgoing traffic. A pattern-based detection might identify a string that resembles a GitHub token. However, the token may be invalid, inactive or otherwise not relevant to the organisation's security policy. With a custom validation function, a Worker can submit the detected token to the appropriate GitHub endpoint and interpret the response. The result can influence whether the DLP detection remains a match. In Cloudflare's example, a successful response produces a positive validation score, an unauthorised response can veto the detection, and other responses produce a neutral score. This illustrates how an organisation can distinguish between a pattern match and a validated finding. The example also highlights the need to handle errors and unexpected responses carefully. Validation logic must account for service availability and the possibility that a response does not conclusively establish whether a credential is active. ### Reusing validation logic across DLP workflows Cloudflare says custom validation functions can be applied wherever its DLP capabilities protect sensitive information. The goal is to let organisations use their own sources of truth without having to prepare, transfer and maintain every reference dataset inside a separate DLP system. This can be relevant to organisations with frequently changing credentials, internal identifiers or other sensitive values whose status cannot be determined reliably from a static pattern alone. However, the effectiveness of a custom validator depends on the quality of the underlying data, the logic used to interpret results and the failure behaviour configured by the organisation. ### ![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1792149650900-info3--125-.webp) ## 4. Performance, Reliability and Operational Considerations Cloudflare says Gateway and Workers run on the same machines within its distributed network. As a result, dispatching a request to a Worker does not require an additional network hop between separate services. The performance impact is therefore tied to the execution time of the Worker code itself, according to the company. This architecture may reduce the operational overhead associated with separate proxy infrastructure and disconnected automation systems. However, it does not mean custom code has no performance cost. Processing time, external API calls, storage operations and the complexity of the implementation can all affect an individual workflow. Reliability is another consideration. Cloudflare allows administrators to configure fallback behaviour for Custom Functions that fail, time out or return unexpected values. Default values are required by the function contract. Security teams should evaluate these fallback choices carefully. A fail-open approach may preserve access when a validation service is unavailable, while a fail-closed approach may restrict access. The appropriate choice depends on the sensitivity of the resource and the organisation's risk tolerance. Custom code also introduces responsibilities around review, testing, monitoring and change management. Organisations should validate policy behaviour before production deployment and ensure that a failure in a custom integration does not unintentionally weaken a security control. These are implementation considerations, not claims that Cloudflare's announcement eliminates all latency or reliability risks. ## 5. Availability and Pricing Cloudflare's announcement sets out the following availability details: - **Gateway Forward action:** Available in public beta from 15 October 2026. - **Gateway Custom Functions:** Expected to become available before the end of 2026. - **DLP custom validation functions:** Available starting with the announcement. - **Future general availability:** Cloudflare says both Gateway capabilities will be available across all customer plan types at general availability. - **Workers billing:** Traffic dispatched to Workers is billed as standard Worker requests. The integration supports Workers Free, Workers Paid and Workers for Enterprise. Cloudflare notes that Workers Free has execution-time and daily request limits, which organisations should consider when sending significant volumes of Gateway traffic through custom code. The company did not disclose specific pricing figures for the new capabilities in the announcement. Actual costs will depend on applicable Workers usage and the services involved. ## 6. What Comes Next for Cloudflare's Programmable Security Platform? Cloudflare says it is working to expand the points where custom functionality can be invoked across Cloudflare One. Email Security is identified as the next area for further integration. The company also expects the new architecture to make it easier to develop first-party capabilities across Cloudflare One services. It has invited enterprise customers to contact their account teams for implementation discussions, previews of upcoming functionality or notifications about the Custom Functions beta. The announcement builds on Cloudflare's broader programmable SASE direction, which focuses on bringing custom logic closer to the point where security and network decisions are made. The longer-term scope of this approach will depend on how organisations implement these controls, how additional services adopt the architecture and how the platform evolves. The announcement does not establish a specific timeline for every planned integration. ## What This Means for Enterprise Security Teams Cloudflare's update highlights a broader industry shift towards security infrastructure that can be adapted through code rather than limited to fixed policy actions. For enterprises, this could mean fewer separately maintained components for certain traffic transformations, more contextual DLP validation and closer integration between security policy enforcement and internal systems. It also creates a need for disciplined software engineering within security operations. Custom functions and Workers should have clear ownership, version control, appropriate testing and documented failure behaviour. Integrations that process credentials or sensitive data also require careful handling of access permissions, logs and data retention. For developers and platform engineering teams, the announcement illustrates how application code and security policy can work together. For security leaders, the central question is not simply whether a gateway supports custom code, but whether that code can be governed, audited and maintained reliably. Cloudflare is making the security gateway more extensible. The practical value for each organisation will depend on how well its custom logic fits existing security requirements and operational controls. ## Original source https://blog.cloudflare.com/programmable-gateway-dlp/ ## Tags `#Cloudflare` · `#DataLossPrevention` · `#CloudSecurity` · `#ZeroTrust` · `#SecureWebGateway` · `#CloudflareWorkers` · `#SASE` · `#EnterpriseSecurity` --- ## About this content This Markdown news article is the citation-grade twin of [Cloudflare Makes Security Gateway and Data Loss Prevention Programmable with Workers](https://www.xcademia.com/news/cloudflare-makes-security-gateway-and-data-loss-prevention-programmable-with-workers). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://www.xcademia.com/news/cloudflare-makes-security-gateway-and-data-loss-prevention-programmable-with-workers - Publisher: Xcademia, https://www.xcademia.com - Catalogue index: https://www.xcademia.com/llms-full.txt