Updated on Oct 2, 2026
New: Brotli, HTTP/2, HTTP/3, IPv6, WebSockets, Always Online, browser cache TTL and a security level picker in zone settings. Worker Routes and Health Checks per domain.
Protect a tunnel hostname with Cloudflare Access. Delete R2 buckets, load balancers, pools and domains. Switch managed WAF rulesets on or off. Multi-line TXT records.
Fixed: WAF rule switches now save, and turning off Under Attack returns to your previous security level.
