Traffic sequence: order is everything

FOUNDATIONCloudflare

Traffic sequence: order is everything

Security first

DDoS scrubbing, then Security Rules (WAF), Bot Management, and Access — all before your rules run.

ERE: Edge Rules Engine

Redirects, rewrites, configuration, origin, transforms, then Cache Rules — a fixed order that supersedes legacy Page Rules.

Cache, Workers, origin

Cache is consulted, Workers run, and only then does traffic leave for origin via Load Balancing or Argo.

Why it matters

A 'broken' Transform Rule or a Worker reading a stale header is almost always an ordering surprise.

Cloudflare Application Performance06