Summary
On August 20, 2026, Cloudflare expanded its WAF leaked-credentials detection to inspect the Authorization request header for HTTP Basic Authentication credentials, extending coverage beyond the request body and query string it previously scanned.
What changed
Cloudflare's WAF leaked-credentials detection began scanning the Authorization request header for Basic Authentication credentials, adding to its existing inspection of request bodies and query strings so exposed or previously-breached credentials sent via Basic Auth are now flagged.
Why it matters
Basic Auth in the Authorization header is a common path for credential stuffing and reuse of leaked secrets; covering it closes a real detection gap and strengthens Cloudflare's account-takeover defenses without customers changing application code.
Evidence excerpt
The leaked credentials detection system now scans the Authorization request header for Basic Authentication credentials, expanding beyond previous body and query string inspection.