Cloudflare Application Profiles checks whether web requests fit expected shapes

Cloudflare announced Application Profiles on 29 September to extend learned request validation to web applications. The service observes traffic structure and format, then identifies requests that do not fit a learned profile. An operation expecting a numeric product identifier, for example, can flag a value of another type without matching a known attack signature.

The classification adds metadata rather than automatically blocking every mismatch. Customers inspect the signal and create enforcement rules where appropriate; operations without a profile are not classified by this feature. Cloudflare opened a closed beta for invited Enterprise customers without API Security, while customers with API Security already had access. Profile quality and the choice of enforcement matter because a legitimate application change can also alter a request’s shape.