---
description: Use reported detection failures to control how your rules handle requests.
title: Failed detections field available in Rules
image: https://developers.cloudflare.com/changelog/post/2026-10-09-failed-detections/og.png?v=ee7ede1aa5f8da21
---

[Skip to content](#main-content)

[View RSS feeds](https://developers.cloudflare.com/fundamentals/new-features/available-rss-feeds/) [ Subscribe to RSS](https://developers.cloudflare.com/changelog/rss/index.xml)

[Back to all posts](https://developers.cloudflare.com/changelog)

October 9, 2026

## Failed detections field available in Rules

[WAF](https://developers.cloudflare.com/waf/) [Rules](https://developers.cloudflare.com/rules/)

Copy as Markdown| [View as Markdown](https://developers.cloudflare.com/changelog/post/2026-10-09-failed-detections/index.md)| [Agent setup](https://developers.cloudflare.com/agent-setup/)

You can now use `cf.appsec.request.failed_detections` to control how your rules handle requests when a security detection reports a failure.

The field is an `Array<String>` of detection IDs that reports failures from content scanning, WAF attack score, attack signature detection, leaked credentials detection, and AI prompt detections for personally identifiable information (PII), prompt injection, custom topics, and unsafe topics.

The field does not alter the existing behavior of detections. Use it in rules to choose how to handle requests with reported failures.

When no failures are reported, the field returns `[]`. You can use it on all plans, but your plan must still include the detections and rule features you want to use.

Supported rules:

- Custom rules at the zone and account levels
- Rate limiting rules at the zone and account levels
- Request Header Transform Rules at the zone level

Match any reported failure:

```txt
len(cf.appsec.request.failed_detections) gt 0
```

Match a reported leaked credentials detection failure:

```txt
any(cf.appsec.request.failed_detections[*] eq "waf_credential_check")
```

For more information, refer to the [Failed detections field reference](https://developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/cf.appsec.request.failed_detections/).

```json
{"@context":"https://schema.org","@type":"BlogPosting","@id":"https://developers.cloudflare.com/changelog/post/2026-10-09-failed-detections/#page","headline":"Failed detections field available in Rules","description":"Use reported detection failures to control how your rules handle requests.","url":"https://developers.cloudflare.com/changelog/post/2026-10-09-failed-detections/","inLanguage":"en","image":"https://developers.cloudflare.com/changelog/post/2026-10-09-failed-detections/og.png?v=ee7ede1aa5f8da21","dateModified":"2026-10-09","datePublished":"2026-10-09","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}}
```