In short. Cloudflare evaluates custom WAF rules in order, so a Skip exception must precede a terminating rule and cover the rules or phases it should bypass.
Definition: Cloudflare evaluates custom web application firewall (WAF) rules in their configured order. A matching rule with a terminating action, such as Block or Managed Challenge, stops evaluation of later rules and security phases for that request.
Key facts
As of October 2026, Cloudflare documents the following evaluation behavior:
- Cloudflare's custom rules documentation states that an earlier blocking rule prevents later rules from running for the same request.
- The Actions reference classifies Managed Challenge as terminating and Log as non-terminating.
- The security features interoperability guide places custom rules before rate limiting rules and Managed Rules.
- The skip options reference distinguishes skipping the remaining rules in the current ruleset from skipping the remaining custom rules across the current phase.
What determines which rule runs first?
A rule combines an expression, which defines the matching criteria, with an action, which defines what happens on a match. Cloudflare's custom rules overview establishes that these rules run in order. A ruleset groups rules; a phase is a stage of request processing in which rulesets run.
Cloudflare's interoperability guide specifies that account-level rulesets run before zone-level rulesets within each phase. Custom rules run in http_request_firewall_custom, followed by rate limiting in http_ratelimit, Managed Rules in http_request_firewall_managed, and Super Bot Fight Mode in http_request_sbfm. Moving a zone rule within its ruleset changes its local position within this wider sequence.
Which actions stop evaluation?
Cloudflare's Actions reference calls actions that stop evaluation of remaining rules terminating actions. Block denies access to the site. Managed Challenge is also terminating, so a challenge rule can prevent a later custom rule from running.
Log records matching requests and permits evaluation to continue. The same reference limits Log to Enterprise plans and recommends it for validating rules before applying a more severe action. Consequently, the effect of a matching rule depends on its action as well as its position: a match alone does not end evaluation.
Where should a Skip exception sit?
A Skip exception must run before the blocking rule it is intended to bypass. This placement follows from Cloudflare's documented evaluation order: a request blocked earlier never reaches the exception.
The exception also needs the appropriate scope. Cloudflare's skip options reference states that All remaining custom rules skips the current ruleset's remaining rules. The zone-level All remaining custom rules in this phase option also covers rules in custom rulesets executed later in that phase.
Skipping later security phases is separately configurable. The same reference lists rate limiting, Super Bot Fight Mode, and WAF Managed Rules as eligible phases. A Skip rule configured only for Managed Rules therefore leaves later custom rules eligible for evaluation.
How can rule position be changed and checked?
Cloudflare's rule update API documentation supports a position object in a PATCH request. Sending only that object reorders an existing rule while retaining its definition. This request body places the rule first in its ruleset:
{
"position": {
"before": ""
}
}
The same API supports after or index; only one positioning field can be used at a time. For blocked requests, Cloudflare's interoperability troubleshooting instructions direct administrators to Security Events and its Service field to identify which product took action.
Related terms
- How do I apply a Cloudflare WAF rule to one URL path?
- How do I create a skip rule in Cloudflare's WAF?
- How do I check whether a CDN blocked an AI crawler?
FAQ
Does a new API rule automatically run first?
No. Cloudflare's add-rule API documentation says new rules are appended to the existing list by default. You can supply a position object to choose another location.
Can a later Skip rule undo an earlier Block?
No. Cloudflare's custom rules documentation states that later rules do not run when an earlier rule blocks the request. Place your exception before the relevant Block rule.
Can I check whether a request matched my Skip rule?
Cloudflare's skip options documentation provides Log matching requests. If you disable it, matching requests do not appear in Security Events; the API default for custom Skip rules is enabled.
Sources
- Cloudflare, "Custom rules", 16 October 2026
- Cloudflare, "Actions", 23 April 2026
- Cloudflare, "Security features interoperability", 16 October 2026
- Cloudflare, "Available skip options", 13 October 2026
- Cloudflare, "Update a rule in a ruleset", 16 April 2026
- Cloudflare, "Add a rule to a ruleset", 16 April 2026
Check how a page reads to answer engines. Open the GEO score analyzer