The new capability that we built to help defend php2shell is live. The @Cloudflare WAF now has full transaction detection that evaluates the request and the origin response together, and response rules block a match before it reaches the requester. Example from the post: unauthenticated hit on /admin that comes back 200 text/html. Block it. Auth failures and redirects can then pass through untouched. https://t.co/BZOa7G7siI