In short. Create a custom rule with the Skip action, define matching conditions and select the security rules or products to bypass.
Definition: A skip rule is a custom rule in Cloudflare's web application firewall (WAF) that applies the Skip action to matching requests. Its selected options determine which security rules or products those requests bypass.
Key facts
- As of 17 October 2026, Cloudflare's custom rules documentation defines a rule through a matching expression and an action.
- Cloudflare's dashboard guide places custom rule creation under Security rules > Create rule > Custom rules.
- Cloudflare's available skip options include rate limiting rules, Super Bot Fight Mode and WAF Managed Rules. Bot Fight Mode cannot be skipped.
How is the rule created in the dashboard?
Cloudflare's creation guide describes the following workflow:
- Open Security rules, then select Create rule > Custom rules.
- Enter a descriptive Rule name.
- Under When incoming requests match, select an HTTP property in Field, an Operator, and a Value. These conditions define the requests the rule matches.
- Under Then take action, select Skip in Choose action. Select the security features to bypass.
- Select Deploy to activate the rule, or Save as Draft to retain it for later deployment.
The selection in step four follows Cloudflare's skip options reference. Selecting All remaining custom rules skips the remaining rules in the current ruleset, a collection of rules evaluated together. Selecting a phase option bypasses the corresponding processing stage.
Which security features can Skip bypass?
Cloudflare's skip options reference maps the phase options to these API values:
| Security feature | Phase identifier |
|---|---|
| Rate limiting rules | http_ratelimit |
| Super Bot Fight Mode rules | http_request_sbfm |
| WAF Managed Rules | http_request_firewall_managed |
For example, the API action parameter for skipping the Managed Rules phase is:
{
"phases": ["http_request_firewall_managed"]
}
Security products outside the Ruleset Engine, Cloudflare's rule evaluation system, use the separate products action parameter. Available products include Zone Lockdown, User Agent Blocking, Browser Integrity Check, Hotlink Protection, Security Level, and the previous versions of rate limiting and managed rules. Skipping a phase leaves these products outside that bypass.
The All remaining custom rules in this phase option uses phase: "current". It applies only at zone level and also skips rules in custom rulesets executed later in the custom rules phase. An account-level skip rule using phases skips the specified phases at both account and zone levels.
Why do rule order and logging matter?
Cloudflare's custom rules overview states that rules run in order. An earlier Block action stops evaluation, so a skip rule intended to bypass that block must precede it.
Cloudflare's logging option is Log matching requests. Keeping it enabled preserves visibility of matching requests in Security Events. The API default is true; disabling it prevents matching requests from appearing there.
Related terms
- How does Cloudflare evaluate the order of custom WAF rules?
- How do I apply a Cloudflare WAF rule to one URL path?
- How do I match a user agent in a Cloudflare custom rule?
FAQ
Can I skip Bot Fight Mode?
No. Cloudflare's skip options support Super Bot Fight Mode. Bot Fight Mode is excluded.
Does skipping Managed Rules also skip Browser Integrity Check?
No. Under the same documentation's product options, Browser Integrity Check requires a separate product selection. Its case-sensitive API value is bic.
Sources
- Cloudflare, "Custom rules", 16 October 2026
- Cloudflare, "Create a custom rule in the dashboard", 8 October 2026
- Cloudflare, "Available skip options", 13 October 2026
Check how a page reads to answer engines. Open the GEO score analyzer