• AI crawlers by type: Set AI Search, AI Assistants & Agents and AI Training crawlers separately, and let Cloudflare generate robots.txt from your preferences. Session-level bot detection (Precursor) is new too. • Workers issues at a glance: Uncaught exceptions, 5xx responses and error logs from your Workers are grouped into issues you can resolve or ignore. Worker details now list preview URLs too. • Security Insights: Scan a domain for security issues in one tap, then review and dismiss them by severity. • Deeper traffic analytics: New Traffic Breakdown by country or region, status code, path and hostname, plus Security Events. • Cache and rules: Mark cached content as stale so it revalidates with your origin instead of being purged. Cache Response Rules are new, and WAF and cache rules can be validated before you save. • Storage, DNS and domains: R2 buckets and KV namespaces with EU or US data residency are supported, and R2 shows upload and download bandwidth. DNS flags records shadowed by an NS delegation, and you can search for new domains with prices. • Steadier: AI content switches that can’t be turned on are hidden on the Free plan, permission errors link to the permissions you need, and D1 explains when the free daily limit is reached.

• Accurate trial info on the paywall: Accounts that already used the free trial no longer see a trial offer they can't get, so nobody is charged by surprise. Trial length and renewal period now come straight from the App Store. • Steadier: Snippets can no longer be saved when their code failed to load, so live code is never overwritten. KV and R2 lists no longer duplicate entries or get stuck while paging, and leaving live logs early no longer leaves a session behind.

• Landscape and wide screens: You can now use the app in landscape. On wide screens, content stays at a comfortable reading width instead of stretching edge to edge. We also fixed the Domains page sometimes opening blank. • Long lists show everything: If you had more than 100 R2 buckets, or more than 20 email routing rules, destination addresses, Durable Objects or Hyperdrive configs, the rest never showed up. They're all listed now, and newly added email addresses that aren't verified yet appear too. • Steadier, fewer interruptions: A blocked network, such as a public Wi-Fi sign-in page or a WAF challenge, no longer signs you out by mistake. We fixed an occasional crash on launch, and pulling to refresh or quickly switching time ranges no longer shows “Cancelled” or mismatched data.

• New Historical Logs: from a Worker’s detail page, look back over the past 30 minutes to 3 days, filter by level, search by keyword, and open any line for its status code, duration and Ray ID. The Worker needs Observability enabled. • Fixed: tapping Update code on a large bundled script froze the whole screen. The editor has been rebuilt — oversized or minified scripts become read-only and offer an import-and-replace path, with variables, secrets and bindings preserved.

• Snippet trigger rules are now editable: tap a rule to change its expression and description instead of deleting and re-adding it, and the rule keeps its place in the order.

• Manage Turnstile from your pocket: a new entry on the overview lets you browse all widgets, create and edit domains and modes, rotate secrets with an optional 2-hour grace period, and tap to copy the sitekey or secret. • Query R2 Data Catalog with SQL: bucket settings gain an R2 SQL console — tap a table to start a query and view results in a grid. Billed by data scanned (first 10 GB per month free); the console reminds you. • Bulk-import Worker secrets: paste a JSON object to write variables or secrets in bulk, powered by Cloudflare's new bulk endpoint — one atomic call instead of saving one by one. • Cache Rules learn JA3/JA4: quick-insert chips add JA3/JA4 fingerprint fields, and rules using Vary-based caching turn read-only so edits can't drop that config.

• Block AI crawlers with one switch: Zone details now has an AI crawlers row with three modes: off, ad pages only, or block everywhere. The two AI content settings moved to the same screen, so you no longer need the dashboard. • Cloudflare pings you when your origin goes down: Zone details now lists standalone health checks — status and failure reason per origin, swipe to suspend or delete. Turn on origin alerts and Cloudflare pushes you the moment status changes, whether or not the app is running. • See domain expiry at a glance: The overview gains a Registrar section: for domains registered with Cloudflare you get expiry date, auto-renew and transfer lock in one list, with the ones expiring soon called out. • See what a request actually hits inside Cloudflare: The overview gains Request Tracing: enter a URL and see, step by step, which rules the request hits — redirects, WAF, cache rules, Workers — and whether each one fired. No more guessing why a rule didn’t apply. • DNSSEC and advanced DNS settings: Zone details gains a DNS settings screen: switch DNSSEC on or off and copy the DS record you need to paste at your registrar, plus adjust CNAME flattening and the nameserver type. • Get told when a Worker build fails: Worker details now show build history — status, duration and what triggered each build. Watch the Workers you care about and you’ll get a notification when a build fails. • More modules, and a lot of polish: Added R2 Data Catalog, Managed Transforms, URL security scanning and the Email suppression list. Tap any audit log entry to see the full change history of that resource; cache rule expressions got quick-insert chips for common fields (including bot score and source ASN); and Durable Objects now show memory percentiles. Also fixed tunnel details not listing active connections.

• Pause Cloudflare in one tap: Actions in the zone details now has a “Pause Cloudflare” switch. While paused, traffic no longer passes through Cloudflare — WAF, caching and origin IP masking stop working, while DNS is still resolved by Cloudflare. Resuming is one tap too, and either change takes about 5 minutes. • Smoother Overview: Opening the subscription details for a Pro feature from Overview no longer re-renders the whole page, so it appears and dismisses without stutter.

• Remembers your default account: With more than one Cloudflare account, the app now remembers the one you picked last and opens straight into it, instead of always falling back to the first in the list.

• Search everything from one place: The magnifier on the overview searches domains, Workers, R2 buckets, D1 databases, KV namespaces and tunnels at once — tap a result to go straight there. And any resource can now be starred to the overview. • Alert center: The overview now gathers what needs attention — inactive domains, tunnels in a bad state and more — into a single card. Tap an item to jump right to it. • Better live logs: Live Worker logs now support keyword search and level filtering; long-press to copy a whole line, tap to expand the full detail and select any part of it. Pause now only freezes the view — logs keep arriving, so nothing is missing when you resume. • SQL history and favorites: D1 keeps your last 12 queries and lets you favorite the ones you reuse (saved per database). Results export to CSV in a tap, and table details now list indexes. • Generate images with Workers AI: The model playground now covers text-to-image models — type a prompt, get a picture, then share or save it.

• One-tap workers.dev URL: When a Worker’s workers.dev subdomain is on, its full URL now shows right there — tap to open. • Quickly bind D1 / KV: Bind an existing D1 database or KV namespace to a Worker right from the bindings page — and unbind just as easily. • Quickly bind R2 buckets: Resource bindings now cover R2 — attach an existing bucket to a Worker, and unbind it just like D1 / KV.

• Worker deployment history: See every past deployment of a Worker and delete older ones you no longer need. • Edit and delete Workers in place: Load the live source, edit it and redeploy — your variables, secrets and bindings are kept. You can also import from a .js file or delete the whole Worker. • Delete D1 tables: Long-press any table in the query console to drop it, with a type-the-name confirmation.

• Edit WAF rules: WAF custom firewall rules can now be edited: tap any rule to change its action, expression, name and enabled state — no need to delete and recreate it. • Stability fixes: Fixes freezes and crashes when tapping “Access Apps / Gateway Policies / Bulk Redirects” on the Overview page (most noticeable on iOS 17), along with similar navigation issues such as Pages project sub-pages failing to open. Startup crashes caused by a corrupted cache database on a few iOS 17.0 devices are now repaired automatically, and two rare exits around the sign-in callback and background token refresh are fixed.

• Rules hub: Domain details gain a unified “Rules” entry: Single Redirects, Origin, Configuration, Compression and Custom Error rules with view, toggle, create, edit and delete; Page Rules and URL Normalization support view and toggle. • Pages custom domains: Manage custom domains right inside a Pages project: add, remove, re-validate, and check DNS status — with one-tap CNAME setup when the domain’s zone is on your account. • List sorting: Workers and Pages lists can now be sorted by name (default), date created, or recently updated — your choice is remembered. • More reliable sign-in: Fixes the root cause of being signed out unexpectedly: the authorization flow now obtains long-lived credentials, so your session no longer lapses when the token expires. If authorization does become invalid, Overview offers one-tap re-authorization. • Insider Program: New opt-in Insider Program, off by default: join to share anonymous diagnostics that help us pinpoint crashes and sign-in issues faster. No personal data is collected. • Data unit display: Storage and traffic sizes now always use the universal unit symbols (KB / MB / GB) in every language, instead of localized unit names. • Stability fixes: Fixes multiple crashes and freezes on iOS 17.0 across Overview, resource lists and domain details, plus the Tunnel page hanging and doubled requests on cold launch. • Smoother scrolling: Glass cards are rendered with far less overhead while looking identical — lists and Overview scroll noticeably smoother, especially on older devices.

• Access: fixed only the first of multiple public hostnames showing — you can now view and edit all of them. • Fixed a rare “stays signed in but won’t refresh data” after long use that previously required signing out of all accounts. • Fixed duplicate, undeletable R2 bucket mounts in the system Files app after reinstalling. • Polish: the Reduce Animations setting now truly takes effect; Overview usage shows the last data first, then refreshes in the background.

• Push Center: A built-in push service: get your own endpoint and send messages to this device with a simple curl or script — with titles, groups, sounds and end-to-end encryption. No Cloudflare sign-in required. • No-login developer toolbox: A set of handy network tools you can use without signing in: DNS lookup, SSL certificate inspection, HTTP headers, WHOIS, IP geolocation, a CIDR calculator and Cloudflare trace — reachable right from the login screen. • Cloudflare alerts on your phone: Once signed in, manage your Cloudflare alert policies right here: pick the alert types you care about (DDoS, health checks, certificate expiry, Workers error rate and more) and wire them to the Push Center in one tap, so events land on this device. Requires a domain on a Pro or higher plan. • Developer Platform goes further: Queues can now pause/resume delivery, purge messages, and adjust retention and delay; Hyperdrive lets you edit query caching and the origin database connection; Durable Objects can browse object instances; and Workers AI runs text-generation models right in the app — with one-tap permission top-up, no sign-out needed.

Stability fixes and minor improvements.

• A new Developer Platform: Workers, Pages, Queues, Durable Objects, Hyperdrive, Workers AI and AI Gateway now share one tab, grouped into Compute / Data & Messaging / AI to mirror Cloudflare's own layout. • Create resources, not just view them: Spin up R2 buckets, KV namespaces, Pages projects, Queues, Hyperdrive and AI Gateway right in the app — and delete them too. • Deploy Pages and Workers: Pages supports Direct Upload deploys (paste code or pick files/ZIP); Workers can be created and updated whole-script, with bulk JSON import for vars and secrets. • Zero Trust editing: Create, edit and remove Access self-hosted apps and policies, plus Gateway DNS / HTTP / network policies — with an expression editor and a per-type selector palette. • Visual WAF rule builder: When writing a custom rule, switch any time between a guided rule builder and the raw expression editor. • Easier authorization: The authorization screen adds quick presets — all read-only, all read-write, or required-only. New modules like Queues, AI Gateway and Workers AI need a fresh authorization to light up. • Open R2 in the Files app: Mount an R2 bucket right inside the system Files app — browse, upload, download and rename like iCloud Drive, and open files in any app. A Pro feature. • On-device AI assistant: Create a DNS record from a sentence, or get a one-line summary of your traffic analytics — all on-device and offline, nothing leaves your iPhone. Requires iOS 26 and an Apple Intelligence–capable device. A Pro feature. • Global traffic map: See where your traffic comes from at a glance — requests and threats plotted by country on a world map. A Pro feature. • Experience & stability improvements: A new “Reduce Animations” toggle makes the interface feel snappier, multi-account switching is more reliable, and data is pre-warmed in the background so you see the latest content faster when you return.

• Cache Rules: Customize edge and browser cache TTLs per URL or bypass cache entirely — manage cache rules right from your phone. • Load Balancing: View and manage load balancers, origin pools, and health monitors — stay on top of traffic steering and origin health. • Cloudflare Pages: Browse Pages projects and deployments, retry / roll back / delete deployments, and edit build configuration. • Email Routing: Turn Email Routing on or off, create and edit forwarding rules, and manage your account's verified destination addresses. • Rate Limiting: Create and manage rate limiting rules: cap requests per visitor IP within a time window, then block or challenge when exceeded. • Zero Trust: View apps protected by Cloudflare Access, along with your Gateway DNS / HTTP / network filtering policies. • Stability fixes: Fixed a rare crash when opening the dashboard on some devices running iOS 17.0.

• SSL Certificates & Encryption: View your domain's edge certificates and expiry dates, toggle Universal SSL, and adjust the SSL/TLS encryption mode. • Transform Rules: View and edit URL rewrite, request header, and response header rules — manage traffic transformations right from your phone. • IP Access Rules: Block, challenge, or allow visitors by IP, IP range, ASN, or country — add and remove rules anytime. • R2 Storage Upgrades: Browse objects by folder, copy or move files, view per-bucket usage, and manage public access domains and CORS. • Purge Cache by URL: Refresh the cache for specific URLs without clearing the whole site — plus a new performance and cache settings page. • More Languages & Stability: Added German, French, Arabic, and Turkish, plus improved crash diagnostics to track down tricky issues faster. • WAF Rules in Plain Language: On devices with Apple Intelligence, describe what you want in a sentence to generate a WAF custom rule — and translate existing rules into plain words. Runs entirely on-device, offline. • Launch Crash Fix: Fixed an issue where the app could crash on launch on some iOS 17 devices. • More Reliable Sign-In: Sign-in details are now kept securely on your device only, fixing occasional unexpected sign-outs. Sign-in state is no longer synced across devices via iCloud.

• Add Domain: add a domain you already own to your account and get the name servers to set at your registrar • Full Worker management: environment variables and secrets, Cron triggers, plus workers.dev subdomain, custom domains, and routes • Cloudflare Tunnel: create tunnels, get connection tokens and commands, and configure public hostname routing • D1 databases: create one, or delete it safely after confirming its name • New app icon: a Liquid Glass icon rebuilt with Icon Composer that adapts to light, dark, and tinted modes (iOS 18 and later) • Fixed a Worker's domains and routes failing to load for some accounts • Fixed a rare startup issue caused by a corrupted local cache, plus various refinements

• Apple Watch app: your domains and 24-hour requests on your wrist, plus watch-face complications • Lock Screen widgets: account requests, a domain's traffic, or your usage gauge — a glance away • Snippets: view, edit, and create Cloudflare edge code snippets and their rules from any domain (Pro) • Fully accessible: VoiceOver, larger text, sufficient contrast, and never color alone • Added Spanish, Korean, and Portuguese — now in nine languages • Refresh failures no longer interrupt with alerts, pull-to-refresh is steadier, plus fixes throughout