Changelog

Radar has expanded its security insights, providing visibility into aggregate trends in authentication requests, including the detection of leaked credentials through leaked credentials detection scans.

We have now introduced the following endpoints:

• /leaked_credential_checks/summary/{dimension}: Retrieves summaries of HTTP authentication requests distribution across two different dimensions.
• /leaked_credential_checks/timeseries_groups/{dimension}: Retrieves timeseries data for HTTP authentication requests distribution across two different dimensions.

The following dimensions are available, displaying the distribution of HTTP authentication requests based on:

• compromised: Credential status (clean vs. compromised).
• bot_class: Bot class (human vs. bot).

Dive deeper into leaked credential detection in this blog post ↗︎ and learn more about the expanded Radar security insights in our blog post ↗︎.

Digital Experience Monitoring (DEX) provides visibility into device, network, and application performance across your Cloudflare SASE deployment. The latest release of the Cloudflare One agent (v2025.1.861) now includes device endpoint monitoring capabilities to provide deeper visibility into end-user device performance which can be analyzed directly from the dashboard.

Device health metrics are now automatically collected, allowing administrators to:

• View the last network a user was connected to
• Monitor CPU and RAM utilization on devices
• Identify resource-intensive processes running on endpoints

This feature complements existing DEX features like synthetic application monitoring and network path visualization, creating a comprehensive troubleshooting workflow that connects application performance with device state.

For more details refer to our DEX documentation.

We’ve streamlined the Logpush setup process by integrating R2 bucket creation directly into the Logpush workflow!

Now, you no longer need to navigate multiple pages to manually create an R2 bucket or copy credentials. With this update, you can seamlessly configure a Logpush job to R2 in just one click, reducing friction and making setup faster and easier.

This enhancement makes it easier for customers to adopt Logpush and R2.

For more details refer to our Logs documentation.

Radar has expanded its DNS insights, providing visibility into aggregated traffic and usage trends observed by our 1.1.1.1 DNS resolver. In addition to global, location, and ASN traffic trends, we are also providing perspectives on protocol usage, query/response characteristics, and DNSSEC usage.

Previously limited to the top locations and ASes endpoints, we have now introduced the following endpoints:

• /dns/timeseries: Retrieves DNS query volume over time.
• /dns/summary/{dimension}: Retrieves summaries of DNS query distribution across ten different dimensions.
• /dns/timeseries_groups/{dimension}: Retrieves timeseries data for DNS query distribution across ten different dimensions.

For the summary and timeseries_groups endpoints, the following dimensions are available, displaying the distribution of DNS queries based on:

• cache_hit: Cache status (hit vs. miss).
• dnsssec: DNSSEC support status (secure, insecure, invalid or other).
• dnsssec_aware: DNSSEC client awareness (aware vs. not-aware).
• dnsssec_e2e: End-to-end security (secure vs. insecure).
• ip_version: IP version (IPv4 vs. IPv6).
• matching_answer: Matching answer status (match vs. no-match).
• protocol: Transport protocol (UDP, TLS, HTTPS or TCP).
• query_type: Query type (A, AAAA, PTR, etc.).
• response_code: Response code (NOERROR, NXDOMAIN, REFUSED, etc.).
• response_ttl: Response TTL.

Learn more about the new Radar DNS insights in our blog post ↗︎, and check out the new Radar page ↗︎.

Previously, you could only configure Zaraz by going to each individual zone under your Cloudflare account. Now, if you’d like to get started with Zaraz or manage your existing configuration, you can navigate to the Tag Management ↗︎ section on the Cloudflare dashboard – this will make it easier to compare and configure the same settings across multiple zones.

These changes will not alter any existing configuration or entitlements for zones you already have Zaraz enabled on. If you’d like to edit existing configurations, you can go to the Tag Setup ↗︎ section of the dashboard, and select the zone you'd like to edit.

Radar has expanded its AI insights with new API endpoints for Internet services rankings, robots.txt analysis, and AI inference data.

Radar now provides rankings for Internet services, including Generative AI platforms, based on anonymized 1.1.1.1 resolver data. Previously limited to the annual Year in Review, these insights are now available daily via the API, through the following endpoints:

• /ranking/internet_services/top show service popularity at a specific date.
• /ranking/internet_services/timeseries_groups track ranking trends over time.

Radar now analyzes robots.txt files from the top 10,000 domains, identifying AI bot access rules. AI-focused user agents from ai.robots.txt ↗︎ are categorized as:

• Fully allowed/disallowed if directives apply to all paths (*).
• Partially allowed/disallowed if restrictions apply to specific paths.

These insights are now available weekly via the API, through the following endpoints:

• /robots_txt/top/user_agents/directive to get the top AI user agents by directive.
• /robots_txt/top/domain_categories to get the top domain categories by robots.txt files.

Radar now provides insights into public AI inference models from Workers AI, tracking usage trends across models and tasks. These insights are now available via the API, through the following endpoints:

• /ai/inference/summary/{dimension} to view aggregated model and task popularity.
• /ai/inference/timeseries_groups/{dimension} to track changes over time for model or task.

Learn more about the new Radar AI insights in our blog post ↗︎.

Cloudflare has introduced new fields to two Gateway-related datasets in Cloudflare Logs:

• Gateway HTTP: ApplicationIDs, ApplicationNames, CategoryIDs, CategoryNames, DestinationIPContinentCode, DestinationIPCountryCode, ProxyEndpoint, SourceIPContinentCode, SourceIPCountryCode, VirtualNetworkID, and VirtualNetworkName.

• Gateway Network: ApplicationIDs, ApplicationNames, DestinationIPContinentCode, DestinationIPCountryCode, ProxyEndpoint, SourceIPContinentCode, SourceIPCountryCode, TransportProtocol, VirtualNetworkID, and VirtualNetworkName.

The free version of Magic Network Monitoring (MNM) is now available to everyone with a Cloudflare account by default.

1. Log in to your Cloudflare dashboard ↗︎, and select your account.
2. Go to Analytics & Logs > Magic Monitoring.

For more details, refer to the Get started guide.

Welcome to your new home for product updates on Cloudflare One.

Our new changelog lets you read about changes in much more depth, offering in-depth examples, images, code samples, and even gifs.

If you are looking for older product updates, refer to the following locations.

You can now easily enable Real User Monitoring (RUM) monitoring for your hostnames, while safely dropping requests from visitors in the European Union to comply with GDPR and CCPA.

Our Web Analytics product has always been centered on giving you insights into your users' experience that you need to provide the best quality experience, without sacrificing user privacy in the process.

To help with that aim, you can now selectively enable RUM monitoring for your hostname and exclude EU visitor data in a single click. If you opt for this option, we will drop all metrics collected by our EU data centers automatically.

You can learn more about what metrics are reported by Web Analytics and how it is collected in the Web Analytics documentation. You can enable Web Analytics on any hostname by going to the Web Analytics ↗︎ section of the dashboard, selecting "Manage Site" for the hostname you want to monitor, and choosing the appropriate enablement option.