Create 2025-09-26-body-phase-selector.mdx (cloudflare#25472)

Co-authored-by: Max Phillips <[email protected]>

Author: warnessa

src/content/changelog/dlp/2025-09-25-body-phase-selector.mdx

@@ -0,0 +1,20 @@
+---
+title: "Refine DLP Scans with New Body Phase Selector"
+description: Gain more control over your DLP detections and reduce false positives by specifying whether to scan the HTTP request or response body.
+products:
+  - gateway
+date: 2025-09-25
+---
+
+You can now more precisely control your HTTP DLP policies by specifying whether to scan the request or response body, helping to reduce false positives and target specific data flows.
+
+In the Gateway HTTP policy builder, you will find a new optional selector called _Body Phase_. This allows you to define the direction of traffic the DLP engine will inspect:
+
+- _Request Body_: Scans data sent from a user's machine to an upstream service. This is ideal for monitoring data uploads, form submissions, or other user-initiated data exfiltration attempts.
+- _Response Body_: Scans data sent to a user's machine from an upstream service. Use this to inspect file downloads and website content for sensitive data.
+
+For example, consider a policy that blocks Social Security Numbers (SSNs). Previously, this policy might trigger when a user visits a website that contains example SSNs in its content (the response body). Now, by setting the **Body Phase** to _Request Body_, the policy will only trigger if the user attempts to upload or submit an SSN, ignoring the content of the web page itself.
+
+All policies without this selector will continue to scan both request and response bodies to ensure continued protection.
+
+For more information, refer to [Gateway HTTP policy selectors](/cloudflare-one/policies/gateway/http-policies/#selectors/).