Firewall Rules actions
Overview
The action of a Firewall Rule tells Cloudflare how to handle HTTP requests that have matched the rule expression.
Supported actions
The table below lists the actions available in Firewall Rules. These actions are listed in order of precedence. If the same request matches two different rules which have the same priority, precedence determines the action to take.
For example, the Allow action takes precedence over the Block action. In a case where a request matches a rule with the Allow action and another with the Block action, precedence resolves the tie, and Cloudflare allows the request.
There are two exceptions to this behavior: the Log and Bypass actions. Unlike other actions, Log and Bypass do not terminate further evaluation within Firewall Rules. This means that if a request matches two different rules and one of those rules specifies the Log or Bypass action, the second action will be triggered instead, even though Log/Bypass has precedence.
| Action | Description | Order of Precedence |
| Log | - Records matching requests in the Cloudflare Logs
- Only available for Enterprise plans
- Recommended for validating rules before committing to a more
severe action
| 1 |
| Bypass | - Allows user to dynamically disable Cloudflare security features
for a request
- Available to all plans
- Matching requests exempt from evaluation by a user-defined list
containing one or more of the following Cloudflare Firewall
products/features:
- User-agent Blocking
- Browser Integrity Check
- Hotlinking Protection
- Security Level (IP Reputation)
- Rate Limiting
- Zone Lockdown (PRO, BIZ, ENT)
- WAF Managed Rules (PRO, BIZ, ENT)
- Requests which match the Bypass action are still subject
to evaluation (and thus a challenge or block) within Firewall
Rules, based on the order of execution.
| 2 |
| Allow | - Matching requests are exempt from challenge and block actions
triggered by other Firewall Rules content.
- The scope of the Allow action is limited to Firewall
Rules; matching requests are not exempt from
action by other Cloudflare Firewall products, such as IP Access
Rules, WAF, etc.
- Matched requests will be mitigated if they are part of a DDoS
attack.
| 3 |
| Legacy CAPTCHA | - This option is not recommended. Instead, choose Managed Challenge (Recommended), which issues CAPTCHAs only when necessary.
- The client that made the request must pass a CAPTCHA challenge.
- If successful, Cloudflare accepts the matched request; otherwise,
it is blocked.
| 4 |
| Managed Challenge (Recommended) | - Helps reduce the lifetimes of human time spent solving CAPTCHAs across the Internet.
- Depending on the characteristics of a request, Cloudflare will perform the following actions:
- Show a non-interactive challenge page (similar to the current JS Challenge).
- Show a CAPTCHA challenge.
| 5 |
| JS Challenge | - Useful for ensuring that bots and spam cannot access the requested
resource; browsers, however, are free to satisfy the challenge
automatically.
- The client that made the request must pass a Cloudflare JavaScript
Challenge before proceeding.
- If successful, Cloudflare accepts the matched request; otherwise,
it is blocked.
| 6 |
| Block | Matching requests are denied access to the site. | 7 |