Cloudflare Gateway adds programmable Workers actions and custom DLP validation
Cloudflare adds a Forward action and custom validation functions to Gateway and DLP, letting Workers run inline in policy evaluation for all Zero Trust plans.
Cloudflare is adding a new type of action to its Gateway secure web gateway, called Forward, along with custom validation functions that let customers run their own code inside the policy evaluation path. The company announced the change on October 15, 2026, and says both capabilities are available to all Zero Trust plans.
The idea is to move beyond the allow, block, isolate or log model that Cloudflare says every secure web gateway on the market has used for nearly 30 years. With Forward, a Cloudflare Worker can transform and manipulate traffic inline, at the moment a security decision is made, rather than in a separate proxy layer.
What the new actions actually do
According to Cloudflare, the integration connects Gateway and DLP to the entirety of its edge computing platform. That means customers can use a Worker to rewrite requests or bring their own data into policy evaluation, instead of standing up dedicated infrastructure for those jobs.
The company describes two common situations it says it has heard from customers over six years of building Gateway. In one, a security team needs to inject HTTP headers based on JSON Web Token claims from its identity provider; because Gateway cannot read the JWT and write the header, the team runs a pool of NGINX proxies just for that transformation. In another, a team wants a Slack alert when an employee signs up for a new SaaS service, and ends up building a Logpush-to-SIEM-to-Slack pipeline that Cloudflare says carries a 5 to 15 minute delay and no guarantee of delivery.
Cloudflare also says dozens of enterprise customers have asked for warning pages that prompt users for justification before allowing access to sensitive destinations, and then want the following behavior customized based on who the user is and what access they requested.
Cloudflare frames it as a compute advantage
In the announcement, Cloudflare argues that its position differs from other firewall vendors because it is a composable compute platform rather than only a firewall, secure web gateway, content delivery network or edge service. The post is attributed to AJ Gerstenhaber and Abe Carryl.
The company has been on a run of platform launches this month, including a Web Search API through AI Gateway and a set of 46 features during Birthday Week 2026.
The new Gateway action and custom validation functions are available to all Zero Trust plans, so existing Gateway and DLP customers can use them without moving to a new tier. Cloudflare has not published separate pricing for the capability in the announcement.
Related reading
Sources
- A fully programmable secure web gateway — Cloudflare Blog
Some links on this page may be affiliate links. If you buy through them we may earn a commission at no extra cost to you. See our affiliate disclosure.
