Cloudflare WAF custom rules: ordering that actually blocks

# WAF custom rules ordering

Custom rules filter incoming traffic with actions like Block, Managed Challenge, and Skip. They are evaluated in order, and terminating actions (Block, Redirect, challenge actions) stop evaluation immediately: if an earlier rule blocks, later rules never run for that request.

## The ordering discipline

1. **Skip rules first.** A Skip rule exempts matching traffic from one or more security features (useful for health checks, monitoring probes, trusted partner IPs). It must appear before the Block rules it is meant to exempt, or the block fires first and the skip never runs.
2. **Specific blocks next.** Narrow, high-confidence blocks (known bad paths, attack signatures for your stack).
3. **Broad challenges last.** Managed Challenge for suspicious-but-uncertain traffic.

## The failure modes

- Adding a Block rule above an existing Skip: your monitoring starts failing health checks and pages you at 3am.
- Two rules matching the same request with different actions: the first terminating action wins. Later rules are dead config; audit for them.
- Custom rules vs Managed Rulesets vs Bot Fight Mode: these are separate features with their own execution order. A request can pass your custom rules and still be stopped by a managed ruleset. Use the Security features interoperability doc to map the full order.

## Checklist

- After any reorder, send test requests that should hit each rule and confirm in the WAF events log which rule fired.
- Name rules by intent ("skip-health-checks", "block-wp-login-probes") so ordering reviews are readable.
- Review quarterly: stale IP allows and dead rules accumulate.