Enhanced security and simplified controls with automated botnet protection, cipher suite selection, and URL Scanner updates

Cloudflare overhauls Security Level, TLS cipher controls, and URL Scanner

Cloudflare has shipped a batch of updates across its security portfolio, touching three distinct areas: its managed Security Level feature now runs without manual thresholds, cipher suite configuration is available in the dashboard for the first time, and URL Scanner gains bulk scanning and new analysis tools.

Security Level now automated with botnet tracking

Cloudflare's Security Level feature, available on all plans including free, has historically used a simple model: assign a threat score to each connecting IP based on observed behavior, then issue a managed challenge when that score crosses a customer-configurable threshold. That logic is being retired in favor of an automated system that combines multiple signals.

The updated system, which has actually been running since February 2024, merges a real-time DDoS score with traffic threshold analysis and a dedicated botnet tracking system. Cloudflare says this behavioral approach has proven more accurate than relying on IP addresses alone, with a notable reduction in false positives. That matters because IP-based scoring has become increasingly unreliable: carrier-grade NATs (CGNATs) and outbound forward proxies — including Cloudflare's own WARP — routinely place many users behind a single IP, and attackers are adept at rotating addresses via VPNs and botnets.

The new botnet tracking system continuously monitors traffic across Cloudflare's network, maintaining a dynamic database of botnet-associated IPs. It also examines traffic properties such as path, accept, and host headers to refine detection of "bad" IP surges. The settings are now labeled "Always protected" in the dashboard and are enabled by default on every plan.

Two things are changing for existing rules. The ip_threat_score field in WAF Custom Rules will no longer be populated, and effective March 17, 2025, manual rule configuration using the threat score parameter will be removed from the dashboard. By the end of Q1 2026, Cloudflare plans to fully disable rules that rely on IP threat score, meaning the parameter will stop working in the Rulesets API and Terraform. Customers are encouraged to update or remove affected rules immediately. The "I'm Under Attack" mode remains unchanged and available.

Cipher suite selection arrives in the dashboard

Managing TLS cipher suites previously required multiple API calls. Now, zone administrators can handle it under Edge Certificates in the SSL/TLS dashboard, with three guided flows designed to match deployment goals.

First, security recommendations are offered as selectable presets:

• Modern: Maximum security and performance with Perfect Forward Secrecy and Authenticated Encryption (AEAD). Requires TLS 1.3 enabled and minimum TLS version 1.2.
• Compatible: Forward-secret suites with broad compatibility for older systems. Also requires TLS 1.3 and minimum TLS 1.2.
• Legacy: Widest reach for older devices; suited for customers who don't handle sensitive data.

Second, compliance presets simplify meeting regulatory standards. The PCI DSS option restricts selection to suites compliant with cardholder data standards, and forces minimum TLS 1.2 with TLS 1.3 enabled. This preset will be disabled until zone settings match those requirements, ensuring customers are genuinely compliant. The FIPS 140-2 preset tailors suites to federal cryptographic module standards.

Third, custom selection gives precise control over individual suites, excluding TLS 1.3 suites, which are automatically enabled with TLS 1.3. Guardrails check that the minimum TLS version aligns with selected suites and that certificate types are compatible (RSA certs require RSA suites).

For API-reliant customers, the existing API remains available and continues to support the same configuration. One differentiator: only the API preserves the exact order of cipher suites as set, since order controls suite preference during the TLS handshake. Those using various default and custom flows configure suites from the dashboard via options like Modern, Compatible, and Legacy recommendations.

The features are available with Advanced Certificate Manager or Cloudflare for SaaS subscriptions.

URL Scanner introduces bulk scanning and deeper pivoting

Cloudflare's URL Scanner, used internally by its Trust & Safety team to identify phishing and malware, has been expanded with features aimed at external security analysts and threat intel users.

Bulk scan submissions

Enterprise customers can now submit up to 100 URLs for scanning at once via a new bulk endpoint. This addresses a common bottleneck: threat hunters maintaining long URL lists who previously had to submit one by one, a historically slow and manual process.

Regular scans use a Durable Object with an ID matching the scan, storing options then scheduling an alarm for a few seconds later. The alarm triggers and starts the scan asynchronously, letting Cloudflare respond immediately to submission.

Bulk scans take a different path. Instead of creating Durable Objects, the system pushes each URL from the bulk submission to a Cloudflare Queues message queue. Processing begins when messages are consumed, and timing depends on queue depth and throughput — scans may take minutes rather than seconds. That tradeoff is acceptable for bulk workflows, where eventual completion matters more than immediate results. Configurable queue properties such as retries, max batch size, max batch timeout, and max concurrency are useful in this setup. Scan results can be fetched via the API when done.

Search by indicators of compromise

Users can now pivot searches using IOCs such as IP addresses and hashes directly in the UI. Additional filters enable matching by screenshot, favicon, and HTML body content. Searching by HTML structure is particularly valuable: attackers vary the visual appearance of phishing pages to evade detection, but they often leave underlying HTML similarities intact, allowing investigators to connect pages to known campaigns.

Hash search is similarly powerful for malware analysis. A user identifying a malicious JavaScript file can search by its hash, discovering other sites serving the same file. Clicking an HTTP transaction in a report reveals the associated hash, enabling direct pivoting to other potentially compromised hosts.

Each scan report now includes a Related Scans tab showing thumbnails or similar URLs based on shared attributes such as identical favicons, similar HTML, or matched IP addresses. Results display scanned URLs with links to full reports, filterable by those criteria. These related scans are viewable across the API, Cloudflare dashboard, and Radar.

Report and download updates

HAR (HTTP Archive) file downloads are now available alongside JSON reports. HAR files capture a detailed record of browser-to-site interactions — request and response headers, timings, status codes — providing analysts with network-level insights like unexpected redirects. JSON reports deliver structured scan results with security verdicts and IOCs, ready for integration into automated security workflows.

UI improvements include page title and favicon display, detailed scan summaries, visible redirect chains, and file scanning for URLs that trigger automatic file downloads, allowing analysis of files fetched during a scan.

A new API version has been released, and going forward all future features will target it. There's no immediate deprecation of the older API version; existing integrations continue to work, offering time for this transition.