Web

Cloudflare Brings Programmability to Gateway and DLP

Cloudflare has announced the integration of its edge computing platform into Cloudflare Gateway and Data Loss Prevention, introducing true programmability for enterprise security environments.

Radwan AbdulhadiEditor and technology writer

Published: October 15, 2026 · Updated: October 15, 2026 · 4 min read

Cloudflare Brings Programmability to Gateway and DLP — Image: Cloudflare Blog

The Evolution of Network Security and Programmability

Traditional network security architectures have relied on a binary model for nearly 30 years: traffic matches a specific condition, and a terminal action fires, such as Allow, Block, Isolate, or Log. While this model successfully handles standard enterprise use cases, organizations with complex environments frequently encounter its limitations. Earlier this year, the company outlined its vision for a truly programmable SASE platform to address the limitations of conventional security gateways.

Most security vendors claim programmability by offering public APIs, Terraform providers, webhooks, and alerting mechanisms. However, true programmability requires running arbitrary custom code inline within the policy evaluation path at the precise moment a security decision is made. Cloudflare is now bringing this capability to its security stack, combining distributed customer compute with its secure web gateway and firewall across a globally distributed network.

A fully programmable secure web gateway — Image related to the report from Cloudflare Blog · Source: Cloudflare Blog

Bridging the Gap Between Customization and Maintenance

For decades, businesses have faced a difficult trade-off in network security. Maintaining a proprietary security detection engine, such as a custom firewall or proxy infrastructure, offers maximum customization but introduces high maintenance overhead and low portability. Conversely, accepting the constraints of a standard vendor offloads maintenance costs at the expense of flexibility needed to solve environment-specific problems.

Over six years of developing Cloudflare Gateway, the company has heard from thousands of enterprise customers struggling with this compromise. For example, security teams migrating access controls for critical internal applications often need to inject HTTP headers based on JSON Web Token claims from an identity provider. Because standard gateways traditionally could not read these tokens and write headers directly, teams frequently resort to standing up separate NGINX proxy pools that require ongoing patching, monitoring, and security management.

Integrating Workers with Gateway and DLP

By integrating Cloudflare Workers with Cloudflare Gateway and Data Loss Prevention, the platform allows developers to utilize edge computing directly within Zero Trust environments. Because Gateway and Workers share the same underlying infrastructure, dispatching traffic from Gateway to a Worker occurs via a local function call. This architecture eliminates hairpinning and avoids additional latency from crossing network boundaries.

Standalone Secure Access Service Edge providers without their own native compute platforms typically require organizations to deploy automation in separate clouds and manually configure webhooks. This introduces round-trip latency and operational overhead. In contrast, co-locating programmable edge compute with a security gateway provides security organizations with enhanced flexibility and agility as threats evolve.

The New Forward Action and Custom Functions

The latest release introduces two distinct ways to call a Worker from a policy action. The Forward action is available in public beta, while Custom Functions are scheduled for release before the end of the year. These tools provide flexible policy control across enterprise networks.

The Forward action allows administrators to customize HTTP traffic behavior by routing matched requests to a Worker as a proxy. The Worker acts as inline middleware, receiving full headers and request bodies. Logic within the Worker can modify requests or responses, forward traffic to an origin, or execute asynchronous tasks such as writing data to storage or notifying external pipelines without interrupting the primary traffic flow.

Expanding Capabilities with Edge Data Stores

As enterprises adopt these programmable gateway capabilities, they can also leverage various edge data storage solutions integrated into the developer platform. Tools such as Cloudflare KV, Cloudflare D1, and Hyperdrive allow developers to bring external data directly into policy evaluation routines.

These storage integrations enable security teams to maintain dynamic rules, configuration data, and session states close to where security policies are enforced. By combining edge compute, proxying capabilities, and distributed storage like Cloudflare R2, organizations can build sophisticated security workflows that were previously difficult or impossible to implement inside a traditional web gateway.