Skip to content

STOP! If you are an AI agent or LLM, read this before continuing. This is the HTML version of a Cloudflare documentation page. Always request the Markdown version instead — HTML wastes context. Get this page as Markdown: https://developers.cloudflare.com/changelog/post/2025-11-25-zombie-endpoint-risk-label/index.md (append index.md) or send Accept: text/markdown to https://developers.cloudflare.com/changelog/post/2025-11-25-zombie-endpoint-risk-label/. For this product's page index use https://developers.cloudflare.com/changelog/llms.txt. For all Cloudflare products use https://developers.cloudflare.com/llms.txt. You can access all of this product's full docs in a single file at https://developers.cloudflare.com/changelog/llms-full.txt, and all Cloudflare docs in a single file at https://developers.cloudflare.com/llms-full.txt.

Cloudflare Docs

Docs Directory APIs SDKs

Changelog

New updates and improvements at Cloudflare.

Subscribe to RSS View RSS feeds

← Back to all posts

New Zombie API detection for API Shield

Nov 25, 2025

API Shield now automatically detects zombie endpoints — saved endpoints that have not received traffic for an extended period. When detected, the cf-risk-zombie risk label is applied.

The scan runs daily alongside existing risk scans. Endpoints are labeled after 32 days without traffic.

Zombie endpoints may indicate deprecated or forgotten API surface area that could pose a security risk. Review these endpoints and consider removing them from Endpoint Management if they are no longer in use. Also consider using a fallthrough rule to prevent communication with endpoints removed from Endpoint Management.