Cloudflare Snippets enters alpha

Cloudflare has made Snippets, its lightweight JavaScript tool for traffic customization, available in alpha. Built on the Workers platform, Snippets are designed to sit between rule-based products and full Workers deployments: small pieces of code that customers can use when the point-and-click basics aren't quite enough, without needing the full Workers toolset. Access will be granted to waitlist members over the coming weeks, with a broader beta expected later this year.

For two years Cloudflare has pushed a number of rules products — Transform Rules, Cache Rules, Origin Rules, Config Rules, Redirect Rules — aimed at giving customers more control over how their traffic is handled. Those products cover the common cases well, but the simple actions aren't enough when the task involves real logic, like computing a value for a header or output. Snippets target that middle ground: users write their own JavaScript, and Cloudflare executes it before the origin response reaches the end user.

How Snippets differ from Workers

Snippets run within the Ruleset Engine as its own dedicated phase, much like Transform Rules and Cache Rules. The practical upshot: a Snippet can be paired with any Ruleset Engine filter. Customers can run one on every request or attach it to targeted conditions like geo, bot score, or cookies. Multiple Snippets are cumulative — a request that matches the conditions for several Snippets runs each of them in sequence, with one Snippet, for example, modifying a header and another rewriting the URL.

The use-case boundary is a good guideline. Rule-based products are still the choice when no logic is involved. Snippets earn their place when the logic is too complicated for a straight mapping, like varying a cookie value based on host or date. And the platform difference is material: Snippets come free with the plan rather than on Workers' paid model. That alone could drive migrations from older systems, including legacy VCL workloads, to Cloudflare.

Plan limits scale along with tier:

  • Free: five Snippets per zone
  • Pro: ten per zone
  • Business: 25 per zone
  • Enterprise: 50 per zone

Snippets are also deliberately resource-constrained: execution is capped at 5ms, memory at 2MB, package size at 32KB. Those caps suggest the intended scope — header changes, URL rewrites, routing logic — not heavier workloads that need a wide-swinging Worker. Snippets run before Workers as well, so requests can be filtered first and moved on to full Workers only when there's depth left to handle.

A useful ruleset-driven refinement: put the traffic-selection logic in the rule outside of the Snippet rather than in the JavaScript. A typical example is setting a dynamic cookie for a percentage of responses — that math lives in the Snippet with math.random, but the rule can narrow execution to, say, only the shop subdomain and only German or UK visitors. Requests outside that scope don't execute any code at all.

Managing and deploying Snippets

Snippets appear in the Rules section of the dashboard, with UI to write, preview, and deploy them. Like other Cloudflare product surfaces, they're also reachable via API and Terraform, which means they can be folded into CI/CD workflows. The Ruleset Engine integration supports staged rollouts: traffic can be gated on an office IP or a secret header for testing only available to internal calls.

Diagnostics improve as well: Snippets will be surfaced in the Account Request Tracer to help users see which rules and Snippets executed on a given request. The Traffic Sequence UI that depicts product run order has been updated to show where Snippets fit in the request lifecycle.

Under the hood

Engineering work on Snippets follows the "Cloudflare on Cloudflare" model from Developer Week: the product is itself implemented on top of Workers for Platforms.

Execution flow works in steps:

  1. When a Snippet is drafted, Cloudflare assigns it a unique Snippet ID.
  2. A user-facing rule with Ruleset Engine syntax gets a unique Rule ID, and the two are paired one-to-one.
  3. At request time, the zone's Snippet rules are evaluated; matched Snippet IDs accumulate into a Snippet table.
  4. That finished table is handed to a Snippets Internal Worker Service, which executes each listed Snippet in order.

The chained execution means a Snippet gets the request—with all previous Snippet modifications—and applies its own alterations before the next takes over. After the final Snippet's ID clears, the modified request returns to the front line for the next stage of traffic processing. Cloudflare cites the independent-Snippet design as intentional: each Snippet can be tuned individually without merging the logic into one unit.