Cloudflare has introduced a way to run customer-written code directly in its secure web gateway and data-loss prevention policy path, a move that could reduce the need for separately hosted proxy and automation infrastructure.
The company said its new programmable Gateway and DLP capabilities include a Forward policy action and Custom Functions. Forward sends matched HTTP traffic to a Cloudflare Worker acting as inline middleware. The Worker can inspect and modify request headers or bodies, process the response, forward the request to its destination, or perform asynchronous actions such as sending a Slack message, writing to R2, calling a webhook or updating KV.
Cloudflare says Gateway continues to handle TCP connections, TLS termination and re-encryption, certificate management, and HTTP version negotiation. The Worker is responsible for transformation logic. The company also says the Worker dispatch is a local function call within its network, rather than traffic being sent through a separate infrastructure boundary. Those are vendor claims; the supplied material does not provide independent latency measurements, reliability data or customer case-study results.
Custom Functions are designed for inline policy evaluation. A Worker receives request context such as source IP, destination, user identity, device posture and HTTP headers, depending on the policy phase, then returns a typed string, number or boolean that can be used in Gateway rule conditions. Cloudflare gives parsing a JWT Authorization header and returning a user role as an example.
The Forward action is available in public beta across Zero Trust plans. Custom Functions are described as coming before the end of the year, so the two capabilities do not yet have the same availability status.
Cloudflare positions Gateway as a cloud-native secure web gateway for employee browsing, threat blocking, shadow-IT discovery and sensitive-data protection. Its Gateway product page describes those existing functions but does not independently verify the new programmability claims. Adoption will still require teams to write, review and operate Worker code and to assess how custom logic affects policy safety and troubleshooting.