Cloudflare Docs
Ruleset Engine
Visit Ruleset Engine on GitHub
Set theme to dark (⇧+D)

Phases list

​​ Network layer

Network-layer phases apply to received packets at the edge.

Phase nameUsed in product/feature
ddos_l4Network-layer DDoS Attack Protection
magic_transitMagic Firewall

​​ Application layer

Application-layer phases apply to received requests at the edge.

​​ Request phases

The phases execute in the order they appear in the table.

Phase nameUsed in product/feature
http_request_sanitizeURL normalization
http_request_transformURL Rewrite Rules
http_request_originOrigin Rules
http_request_dynamic_redirectDynamic Redirects
ddos_l7*HTTP DDoS Attack Protection
http_request_firewall_customWeb Application Firewall (WAF)
http_ratelimitRate limiting rules
http_request_firewall_managedWeb Application Firewall (WAF)
http_request_sbfmSuper Bot Fight Mode
http_request_redirectBulk Redirects
N/A (internal phase)Managed Transforms
http_request_late_transformHTTP Request Header Modification Rules
http_request_cache_settingsCache Rules

* This phase is for configuration purposes only — the corresponding rules will not be executed at this stage in the request handling process.

​​ Response phases

The phases execute in the order they appear in the table.

Phase nameUsed in product/feature
http_custom_errorsCustom error responses
N/A (internal phase)Managed Transforms
http_response_headers_transformHTTP Response Header Modification Rules
http_response_firewall_managedCloudflare Sensitive Data Detection (Data Loss Prevention)
http_log_custom_fieldsLogpush custom fields