Each check below runs in this order. The first one that answers the request (a block, a challenge, a login page, a redirect) ends it; later checks never see it.
| # | Check | Answers | Notes |
|---|---|---|---|
| 1 | HTTPS and canonical name | 301 | ACME HTTP-01 challenges (/.well-known/acme-challenge/) are answered first. Plain HTTP goes to https://. www.<apex> goes to the apex when the apex is a proxied site, unless a redirect rule says otherwise. A name the edge doesn't serve gets 421; ambiguous Transfer-Encoding or Content-Length headers get 400. |
| 2 | Request body size | 413 | max_body_mb. |
| 3 | Access gate | 401 login page | Only on the protected path prefix, without a valid session. |
| 4 | IP rules | 403 | An allow match skips steps 5 and 6 only. |
| 5 | Threat feeds | 403 | When enable_feed is on. |
| 6 | Country rules | 403 | |
| 7 | Rate limiting rules | 429 or challenge | Also for allow-listed IPs, in every WAF mode. |
| 8 | Rate limit rules | 429 | Rules of kind rate_limit. |
| 9 | Basic rate limit | 429 | rate_limit_rpm; off when the WAF is off. |
| 10 | AI Crawl Control | challenge, block or tarpit | Only in enforce mode. |
| 11 | Redirect rules | 301, 302, 307, 308 | |
| 12 | WAF: OWASP CRS and OpenWAF rules | 403 | Depends on mode and level and exceptions. |
| 13 | Stack shields | 403, 404, 413 or 429 | Off when the WAF is off; record only in log-only mode. |
| 14 | Origin | the origin's answer | The response passes through response hardening. |
Paths under /__waf/
The edge serves a few endpoints of its own under /__waf/: /__waf/verify (the browser challenge), /__waf/access/send-code and /__waf/access/verify (the access gate), and AI Crawl Control's trap and tarpit paths. They never reach your origin. A fixed limit protects the first three: 30 POST requests per minute per IP, with a 60-second block.