Core Platform

All customers can now create additional Free accounts through self-serve dashboard flows, and standalone Free accounts can be created programmatically via user-owned API tokens or OAuth access tokens. Super Administrators can also create up to five Free accounts directly within an Enterprise Organization.

Enterprise customers can configure a zone's maximum CDN upload size up to 5 GB from the Network page in the Cloudflare dashboard, without contacting their account team or Support. The default remains 500 MB, limits above 5 GB still require Support, and very large uploads may hit connection or read timeouts before reaching the configured limit.

Log Explorer's dataset configuration now offers grouped field selection, field details with data types and required/deprecated markers, bulk select or reset controls, and ingestion filters for all events or matching conditions.

Cloudflare will stop maintaining the Azure Functions-based Microsoft Sentinel connector after 2026-09-14, when Microsoft retires the Azure Monitor HTTP Data Collector API it depends on. Enterprise customers must migrate to the Cloudflare for Microsoft Sentinel CCF connector before that date.

Log Explorer customers can now permanently delete account and zone datasets from the dashboard or API. Deletion protection is enabled by default to prevent accidental data loss; the delete must be confirmed via dashboard or by first setting deletion_protection to false via the API.

Dashboard SCIM now supports replacing groups using HTTP PUT per RFC 7644 section 3.5.1, enabling identity providers to synchronize a group's display name, external ID, and members in a single request.

Cloudflare API 403 Forbidden responses now include a documentation_url field pointing to the denied endpoint's docs, surfacing the required roles. Available across nearly all product APIs; agents can fetch the docs directly from the error to drive approval workflows.

The http_requests Logpush dataset — also available in Log Explorer — now includes a ClientTLSKeyExchangeGroup field reporting the TLS key exchange group (e.g. X25519MLKEM768 for post-quantum connections), enabling per-zone reports and SIEM integration.

Two new Logpush datasets — Account Abuse Protection Events and Magic BGP Logs — are now available, with fields including authentication metadata, bot scores, and tunnel details. Existing Firewall, Gateway HTTP, and HTTP requests datasets gained several new fields including AI security and WAF signature categories.

OAuth client developers can now mark configured scopes as optional in the Cloudflare dashboard, letting users decline them on the consent screen while required scopes stay mandatory. The consent screen also adds Read Only and Full Access templates and scope search.

Members with only resource-scoped Access roles can now open Access resource list pages and call list endpoints, returning only resources in their permission scopes. Previously these requests returned 403 or were blocked in the dashboard. Filtering applies to applications, policies, service tokens, and identity providers.

HTTP Traffic Analytics and HTTP request logs now correctly count all data transferred across WebSocket connections, fixing an issue where reporting captured only the initial handshake for some connections. The correction restores accounting of existing traffic, not an increase in traffic, and connection behavior is unaffected.

Cloud Connector now routes matching requests to public Oracle Cloud Infrastructure (OCI) Object Storage buckets without a separate origin-routing configuration. OCI support uses the Amazon S3 Compatibility API with both path-style and virtual-hosted endpoint formats; set provider to oci_storage and provide a supported OCI hostname. Buckets must allow anonymous reads — private buckets and pre-authenticated request URLs are not supported.

The rebuilt Cloudflare Status page at the same address keeps all previously documented Status API endpoints working. It adds its own notification system (independent of Cloudflare infrastructure) for email, webhook, Slack, Discord, or Google Chat, Markdown responses for AI agents via Accept: text/markdown, and separate RSS/Atom feeds for incidents versus maintenance.

Hostname routing is now generally available for Cloudflare Tunnel and Cloudflare Mesh, letting you route traffic by hostname instead of static IP lists. The default initial resolved IP range for IPv4 changes from CGNAT to a public Cloudflare-owned range (172.64.128.0/20) to avoid Chrome 142+ Local Network Access restrictions; the IPv6 range is unchanged.

OAuth consent screens now display a colored shield icon beneath the title indicating application ownership: green for Cloudflare-managed apps, blue for third-party apps with verified domain ownership, and amber for third-party apps without verified domain ownership. Domain verification only confirms the owner controls the displayed domain.