Cloudflare WAF custom rules: ordering that actually blocks

TL;DR: They are evaluated in order, and terminating actions (Block, Redirect, challenge actions) stop evaluation immediately: if an earlier rule blocks, later rules never run for that request. ## The ordering discipline 1. # WAF custom rules ordering Custom rules filter incoming traffic with actions like Block, Managed Challenge, and Skip.

WAF custom rules ordering

Custom rules filter incoming traffic with actions like Block, Managed Challenge, and Skip. They are evaluated in order, and terminating actions (Block, Redirect, challenge actions) stop evaluation immediately: if an earlier rule blocks, later rules never run for that request.

The ordering discipline

1. Skip rules first. A Skip rule exempts matching traffic from one or more security features (useful for health checks, monitoring probes, trusted partner IPs). It must appear before the Block rules it is meant to exempt, or the block fires first and the skip never runs.
2. Specific blocks next. Narrow, high-confidence blocks (known bad paths, attack signatures for your stack).
3. Broad challenges last. Managed Challenge for suspicious-but-uncertain traffic.

The failure modes

• Adding a Block rule above an existing Skip: your monitoring starts failing health checks and pages you at 3am.
• Two rules matching the same request with different actions: the first terminating action wins. Later rules are dead config; audit for them.
• Custom rules vs Managed Rulesets vs Bot Fight Mode: these are separate features with their own execution order. A request can pass your custom rules and still be stopped by a managed ruleset. Use the Security features interoperability doc to map the full order.

Checklist

• After any reorder, send test requests that should hit each rule and confirm in the WAF events log which rule fired.
• Name rules by intent ("skip-health-checks", "block-wp-login-probes") so ordering reviews are readable.
• Review quarterly: stale IP allows and dead rules accumulate.

When to use

You hit exactly this: Cloudflare WAF custom rules: ordering that actually blocks in Cloudflare WAF custom rules.

When not to use

A different error, or the same symptom in a different tool. This page only covers the failure above.

Compatibility

Cloudflare WAF custom rules.

Edge cases

• # WAF custom rules ordering Custom rules filter incoming traffic with actions like Block, Managed Challenge, and Skip.
• Later rules are dead config; audit for them. - Custom rules vs Managed Rulesets vs Bot Fight Mode: these are separate features with their own execution order.

Verified against the live WAF Custom Rules doc: evaluated in order, Block stops evaluation, Skip action exempts security features, interoperability with Managed Rules and Bot Fight Mode. Ref: https://developers.cloudflare.com/waf/custom-rules/