# How a request is processed

> The order in which the OpenWAF edge applies size limits, the access gate, IP and country rules, feeds, rate limits, AI policy, redirects, the WAF and shields.

Each check below runs in this order. The first one that answers the request (a block, a challenge, a login page, a redirect) ends it; later checks never see it.

| # | Check | Answers | Notes |
|---|---|---|---|
| 1 | HTTPS and canonical name | 301 | ACME HTTP-01 challenges (`/.well-known/acme-challenge/`) are answered first. Plain HTTP goes to `https://`. `www.<apex>` goes to the apex when the apex is a proxied site, unless a [redirect rule](https://developers.openwaf.dev/rules/redirects/#www-and-the-apex) says otherwise. A name the edge doesn't serve gets 421; ambiguous `Transfer-Encoding` or `Content-Length` headers get 400. |
| 2 | Request body size | 413 | `max_body_mb`. |
| 3 | [Access gate](https://developers.openwaf.dev/waf/access-gate/) | 401 login page | Only on the protected path prefix, without a valid session. |
| 4 | [IP rules](https://developers.openwaf.dev/waf/ip-and-country-rules/) | 403 | An `allow` match skips steps 5 and 6 only. |
| 5 | [Threat feeds](https://developers.openwaf.dev/waf/threat-feeds/) | 403 | When `enable_feed` is on. |
| 6 | [Country rules](https://developers.openwaf.dev/waf/ip-and-country-rules/#country-rules) | 403 | |
| 7 | [Rate limiting rules](https://developers.openwaf.dev/waf/rate-limiting/#per-path-rules) | 429 or challenge | Also for allow-listed IPs, in every WAF mode. |
| 8 | [Rate limit rules](https://developers.openwaf.dev/waf/rate-limiting/#rate-limit-rules) | 429 | Rules of kind `rate_limit`. |
| 9 | [Basic rate limit](https://developers.openwaf.dev/waf/rate-limiting/#basic-rate-limit) | 429 | `rate_limit_rpm`; off when the WAF is off. |
| 10 | [AI Crawl Control](https://developers.openwaf.dev/ai-crawl-control/) | challenge, block or tarpit | Only in enforce mode. |
| 11 | [Redirect rules](https://developers.openwaf.dev/rules/redirects/) | 301, 302, 307, 308 | |
| 12 | WAF: OWASP CRS and OpenWAF rules | 403 | Depends on [mode and level](https://developers.openwaf.dev/waf/modes-and-levels/) and [exceptions](https://developers.openwaf.dev/waf/waf-exceptions/). |
| 13 | [Stack shields](https://developers.openwaf.dev/waf/shields/) | 403, 404, 413 or 429 | Off when the WAF is off; record only in log-only mode. |
| 14 | Origin | the origin's answer | The response passes through [response hardening](https://developers.openwaf.dev/waf/responses/#response-headers). |

> **Caution: An allow rule is not a bypass**
>
> An IP `allow` rule skips threat feeds and country rules. Rate limits, the AI policy, the WAF and the shields still apply, so an office IP cannot flood your login.


## Paths under /__waf/

The edge serves a few endpoints of its own under `/__waf/`: `/__waf/verify` (the [browser challenge](https://developers.openwaf.dev/waf/browser-challenge/)), `/__waf/access/send-code` and `/__waf/access/verify` (the access gate), and AI Crawl Control's trap and tarpit paths. They never reach your origin. A fixed limit protects the first three: 30 `POST` requests per minute per IP, with a 60-second block.