Firewall and Page rules ordering/interaction

Hi, trying to find out the order of processing between page rules and firewall rules.

Are firewall rules processed first, and if something is accepted (or not blocked etc) it then goes through the page rules - or are page rules processed first and then the firewall rules after that?

Page Rules should execute first - as you can disable the security for a specific URL from page rules.

From what I could see in the docs, the ‘disable security’ option turns of the following:

  • Email Obfuscation
  • Rate Limiting
  • Scrape Shield
  • Server Side Excludes
  • URL (Zone) Lockdown
  • WAF

It doesn’t mention turning of the firewall rules.

So is it possible to (for example) do something like a firewall rule that blocks certain IPs or User Agents etc from the whole site, but a page rule that then turns off the other security settings for a given URL - without allowing all to connect to that URL (the firewall blocks remain in place)

I can confirm that Firewall Rules still execute even with “Disable Security” option enabled in page rules. But I’m still not sure whether Page Rules run before or after the Firewall Rules.

You just need to add a condition in your firewall rule not to match the specific URL when you want to block based on IP or user agent. Or, just create a new firewall rule that allows the URL, and then reorder the firewall rule to make it located at the top.