> This page is for Applications Protection.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.humansecurity.com/llms.txt.

# Cloudflare Worker changelog

## July 13, 2026

## Version 6.15.1

### Fixed

* Fixed async activities issue

## July 8, 2026

## Version 6.15.0

### Added

* Support for redirect action—the Enforcer can now return a 302 redirect response when instructed by the Risk API.

## June 18, 2026

## 6.14.0

### Changed

* Support for JWT key names that contain dots (such as URLs) when extracting the user id and additional fields

### Added

* Added `risk_rtt` field to activities in case of S2S timeout

## May 6, 2026

## 6.13.2

### Added

* Terraform deployment support

## April 16, 2026

## 6.13.1

### Added

* Re-export `CustomParameters` and `ResponseCustomParameters` (from `perimeterx-js-core`) on the package entry
* Pass request object to response custom parameters custom function

## March 31, 2026

## 6.13.0

### Added

* MCP Protection support
* Send original vid from cookie on all activities under `orig_cookie_vid`

## October 27, 2025

## Version 6.12.0

* Telemetry activity `update_reason` field updated to reflect the reason for telemetry activity:
  * `command` - incoming telemetry request received
  * `risk` - telemetry triggered via risk response field
* Added `request_id` to telemetry activity details

## September 28, 2025

## Version 6.11.0

* Added `is_sensitive_route` field to risk api and async activities

## September 3, 2025

## Version 6.10.0

* Added Documentation enforcement workflow - verify that the documentation is up to date with the latest changes in the codebase
* Added Block by Header feature support

## August 4, 2025

## Version 6.9.0

* Added support for setting a data enrichment header on the incoming request (`px_data_enrichment_header_name` configuration)

## July 6, 2025

## Version 6.8.2

* Fixed immutable request in additional activity handler issue

## June 26, 2025

## Version 6.8.1

* Fixed Credential Intelligence endpoint configurations refresh on new remote configurations

## June 4, 2025

## Version 6.8.0

* Added remote configuration continuous integration workflow

## May 21, 2025

## Version 6.7.0

* Added support for interpreting regex-formatted strings (e.g., `"/^/regex/path$/i"`) as regular expressions for the following configurations:
  * px_sensitive_routes
  * px_monitored_routes
  * px_enforced_routes
  * px_graphql_routes
  * px_filter_by_route
  * px_filter_by_user_agent
  * px_graphql_keywords
  * px_sensitive_graphql_operation_names

## May 8, 2025

## Version 6.6.0

* Added response_custom_params feature support
* Updated dependencies

## March 18, 2025

## Version 6.5.0

* Added `remote_config_id` and `remote_config_version` to all activities
* Added `px_remote_config_id` as required static configuration field for remote configuration (no longer parsed from auth token)
* Added remote configuration ID to PXKV key name by default to support multiple remote configurations in the same KV Namespace without configurations
* GraphQL functionality extracts operationName and variables even if the query is not present
* Updated dependencies

## December 4, 2024

## Version 6.4.0

* Added support for snippet injection feature (`px_snippet_injection_enabled` and `px_create_custom_snippet` configurations)
* Added `remote_config_id` field to activities

## August 7, 2024

## Version 6.3.2

* Added cookie secret rotation support
* Adding a configuration to include/exclude the request url in captcha block page.
* Support changing the blockers in an easier way
* IUrlSearchParams no longer requires method forEach.
* converted fields: login_successful_reporting_method, sent_through of CredentialEndpointConfiguration to optional.

## July 3, 2024

## Version 6.3.1

* Fixed issue where login successful reporting method of `body` would return false or throw an error due to original response body being used
* Replaced `\\/` with `/` in the regex values reported in the enforcer telemetry activity

## June 24, 2024

## Version 6.3.0

* Added GraphQL query keyword extraction via string/regex (`px_graphql_keywords` configuration) and custom function (`px_extract_graphql_keywords` configuration). This
* Added support for regular expressions in remote configuration fields
* Changed default value for `px_bypass_monitor_header` from empty string to `"x-px-block"`
* Configuration `px_sensitive_graphql_operation_names` expanded to include regular expressions and applies to extracted GraphQL keywords as well
* Telemetry activity includes redacted sensitive configuration fields
* Fixed issue where global regular expressions occasionally failed (only applies to regular expressions defined with the `g` global flag)
* Fixed issue where remote config changes did not change logger severity

_Showing the 20 most recent of 77 entries. Append `/llms.txt` to the changelog URL for the complete index._