导航|地址|刷新
developers.cloudflare.com

--- description: Create and deploy rules and rulesets across Cloudflare products using the Ruleset Engine's powerful syntax and high-performance evaluation. title: Cloudflare Ruleset Engine image: https://developers.cloudflare.com/og-docs.png --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/ruleset-engine/llms.txt > Use this file to discover all available pages before exploring further. # Cloudflare Ruleset Engine Last updated Apr 16, 2026|Copy as Markdown|[View as Markdown](https://developers.cloudflare.com/ruleset-engine/index.md)|[Agent setup](https://developers.cloudflare.com/agent-setup/) The Cloudflare Ruleset Engine allows you to create and deploy rules and rulesets in different Cloudflare products using the same basic syntax. ## Main features * **Powerful syntax**: Rule expressions use a powerful Rules language similar to the wirefilter syntax that allows you to create complex rules. * **High-performance rule evaluation**: Allows you to have many rules in different Cloudflare products with almost no impact on performance. * **Engine powering different Cloudflare products**: Cloudflare keeps building products on top of the Ruleset Engine, which means that you can use the same API methods for configuring different products, with the same customization possibilities. Additionally, the Ruleset Engine supports the different phases of the request life cycle at Cloudflare. ## Availability The Ruleset Engine supports different Cloudflare products. Refer to [Phases list](https://developers.cloudflare.com/ruleset-engine/reference/phases-list/) and to each product's documentation for details. Was this helpful? YesNo ## On this page [Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://developers.cloudflare.com/ruleset-engine/#page","headline":"Overview · Cloudflare Ruleset Engine docs","description":"Create and deploy rules and rulesets across Cloudflare products using the Ruleset Engine's powerful syntax and high-performance evaluation.","url":"https://developers.cloudflare.com/ruleset-engine/","inLanguage":"en","image":"https://developers.cloudflare.com/og-docs.png","dateModified":"2026-04-16","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Core concepts for the Ruleset Engine, including rules, rulesets, and phases. title: About image: https://developers.cloudflare.com/og-docs.png --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/ruleset-engine/llms.txt > Use this file to discover all available pages before exploring further. # About Last updated Apr 16, 2026|Copy as Markdown|[View as Markdown](https://developers.cloudflare.com/ruleset-engine/about/index.md)|[Agent setup](https://developers.cloudflare.com/agent-setup/) The Cloudflare Ruleset Engine allows you to create and deploy rules and rulesets. The engine syntax, inspired by the Wireshark Display Filter language, is defined by the [Rules language](https://developers.cloudflare.com/ruleset-engine/rules-language/). Cloudflare uses the Ruleset Engine in different products, allowing you to configure several products using the same basic syntax. There are several elements involved in the configuration and use of the Ruleset Engine. These elements are: * [**Phase**](https://developers.cloudflare.com/ruleset-engine/about/phases/): Defines a stage in the life of a request where you can execute rulesets. * [**Ruleset**](https://developers.cloudflare.com/ruleset-engine/about/rulesets/): Defines a versioned set of rules. You deploy rulesets to a phase, where they execute. * [**Rule**](https://developers.cloudflare.com/ruleset-engine/about/rules/): Defines a filter and an action to perform on incoming requests that match the filter expression. A rule with an `execute` action executes a ruleset. --- ## Get started To view existing rulesets and their properties, refer to [View rulesets](https://developers.cloudflare.com/ruleset-engine/basic-operations/view-rulesets/). For more information on deploying managed rulesets and defining overrides, refer to [Work with managed rulesets](https://developers.cloudflare.com/ruleset-engine/managed-rulesets/). For more information on creating and deploying custom rulesets, refer to [Work with custom rulesets](https://developers.cloudflare.com/ruleset-engine/custom-rulesets/). Was this helpful? YesNo ## On this page [Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://developers.cloudflare.com/ruleset-engine/about/#page","headline":"About Ruleset Engine · Cloudflare Ruleset Engine docs","description":"Core concepts for the Ruleset Engine, including rules, rulesets, and phases.","url":"https://developers.cloudflare.com/ruleset-engine/about/","inLanguage":"en","image":"https://developers.cloudflare.com/og-docs.png","dateModified":"2026-04-16","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: How phases organize rule execution in the Ruleset Engine request lifecycle. title: Phases image: https://developers.cloudflare.com/og-docs.png --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/ruleset-engine/llms.txt > Use this file to discover all available pages before exploring further. # Phases Last updated Apr 16, 2026|Copy as Markdown|[View as Markdown](https://developers.cloudflare.com/ruleset-engine/about/phases/index.md)|[Agent setup](https://developers.cloudflare.com/agent-setup/) A phase defines a stage in the life of a request where you can execute [rulesets](https://developers.cloudflare.com/ruleset-engine/about/rulesets/). Phases are defined by Cloudflare and cannot be modified. Phases exist at two levels: * At the [account](https://developers.cloudflare.com/fundamentals/concepts/accounts-and-zones/#accounts) level * At the [zone](https://developers.cloudflare.com/fundamentals/concepts/accounts-and-zones/#zones) level For the same phase, rules defined at the account level are evaluated before the rules defined at the zone level. Each phase has at most one [entry point ruleset](https://developers.cloudflare.com/ruleset-engine/about/rulesets/#entry-point-ruleset) at the account and zone level. Note Currently, phases at the account level are only available in Enterprise plans. The following diagram outlines the request handling process where requests go through the available phases:  Cloudflare products are specific to one or more phases, and they add support for different features. Check the documentation for each Cloudflare product for details on the applicable phases. Refer to [Phases list](https://developers.cloudflare.com/ruleset-engine/reference/phases-list/) for a list of phases and their corresponding Cloudflare products. Was this helpful? YesNo ## On this page [Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://developers.cloudflare.com/ruleset-engine/about/phases/#page","headline":"Phases · Cloudflare Ruleset Engine docs","description":"How phases organize rule execution in the Ruleset Engine request lifecycle.","url":"https://developers.cloudflare.com/ruleset-engine/about/phases/","inLanguage":"en","image":"https://developers.cloudflare.com/og-docs.png","dateModified":"2026-04-16","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Structure and properties of rules in the Ruleset Engine. title: Rules image: https://developers.cloudflare.com/og-docs.png --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/ruleset-engine/llms.txt > Use this file to discover all available pages before exploring further. # Rules Last updated Apr 16, 2026|Copy as Markdown|[View as Markdown](https://developers.cloudflare.com/ruleset-engine/about/rules/index.md)|[Agent setup](https://developers.cloudflare.com/agent-setup/) A rule defines a filter and an action to perform on the incoming requests that match the filter. * The rule [expression](https://developers.cloudflare.com/ruleset-engine/rules-language/expressions/), also called filter expression, defines the scope of the rule. * The rule [action](https://developers.cloudflare.com/ruleset-engine/rules-language/actions/) defines what happens when there is a match for the expression. Rule expressions are defined using the [Rules language](https://developers.cloudflare.com/ruleset-engine/rules-language/). For example, consider the following ruleset with four rules (R1, R2, R3, and R4). For a given incoming request, the expression of the first two rules matches the request properties. Therefore, the action for these rules runs (_Execute_ and _Log_, respectively). The action of the first rule executes a managed ruleset, which means that every rule in the managed ruleset is evaluated. The action of the second rule logs an event associated with the current phase. There is no match for the expressions of rules 3 and 4, so their actions do not run. Since no rule blocks the request, it proceeds to the next phase.  Rules can have additional features through specific Cloudflare products. You may have more fields available for rule expressions, perform different actions, or configure additional behavior in a given phase. ## Rule evaluation When evaluating a rule, Cloudflare compares the values of request/response properties or derived values (obtained through [fields](https://developers.cloudflare.com/ruleset-engine/rules-language/fields/)) to those defined in the rule's filter expression. If the entire expression evaluates to `true`, there is a rule match and Cloudflare triggers the [action](https://developers.cloudflare.com/ruleset-engine/rules-language/actions/) configured in the rule. If the expression evaluates to `false`, the rule does not match and its configured action is not applied. Generally speaking, for [non-terminating actions](https://developers.cloudflare.com/ruleset-engine/rules-language/actions/) the last change made by rules in the same [phase](https://developers.cloudflare.com/ruleset-engine/about/phases/) will win (later rules can overwrite changes done by previous rules). However, for terminating actions (_Block_, _Redirect_, or one of the challenge actions), rule evaluation will stop and the action will be executed immediately. For example, if multiple rules with the _Redirect_ action match, Cloudflare will always use the URL redirect of the first rule that matches. Also, if you configure URL redirects using different Cloudflare products (Single Redirects and Bulk Redirects), the product executed first will apply, if there is a rule match (in this case, Single Redirects). Refer to the [Phases list](https://developers.cloudflare.com/ruleset-engine/reference/phases-list/) for the product execution order. When you use `true` as the rule filter expression, this means "apply the rule to every incoming request" at the current [phase](https://developers.cloudflare.com/ruleset-engine/about/phases/) level, which can be zone or account. Notes * A rule filter expression must evaluate to a boolean value (either `true` or `false`). * Rules of specific Cloudflare products, such as [Transform Rules](https://developers.cloudflare.com/rules/transform/), may include other expressions used to specify dynamic values. These expressions do not have to evaluate to a boolean value. ### Field values during rule evaluation While evaluating rules for a given request/response, the values of all request and response [fields](https://developers.cloudflare.com/ruleset-engine/rules-language/fields/) are immutable within each phase. However, field values may change between phases. For example: * If a [URL rewrite rule](https://developers.cloudflare.com/rules/transform/url-rewrite/) #1 updates the URI path or the query string of a request, URL rewrite rule #2 will not take these earlier changes into consideration. * If a [request header transform rule](https://developers.cloudflare.com/rules/transform/request-header-modification/) #1 sets the value of an HTTP request header, request header transform rule #2 will not be able to read or evaluate this new value. * If a URL rewrite rule updates the URI path or query string of a request, the `http.request.uri`, `http.request.uri.*`, and `http.request.full_uri` fields will have a different value in phases after the `http_request_transform` phase (where URL Rewrite Rules are executed). Note If you want to use the original field values in rules evaluated later, you can use raw fields (for example, `raw.http.request.uri.path`) in their expressions. These special fields are immutable during the entire request evaluation workflow. For a list of raw fields, refer to the [Fields reference](https://developers.cloudflare.com/ruleset-engine/rules-language/fields/reference/?field-category=Raw+fields). Was this helpful? YesNo ## On this page [Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://developers.cloudflare.com/ruleset-engine/about/rules/#page","headline":"Rules · Cloudflare Ruleset Engine docs","description":"Structure and properties of rules in the Ruleset Engine.","url":"https://developers.cloudflare.com/ruleset-engine/about/rules/","inLanguage":"en","image":"https://developers.cloudflare.com/og-docs.png","dateModified":"2026-04-16","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: How rulesets group and organize rules in the Ruleset Engine. title: Rulesets image: https://developers.cloudflare.com/og-docs.png --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/ruleset-engine/llms.txt > Use this file to discover all available pages before exploring further. # Rulesets Last updated Apr 16, 2026|Copy as Markdown|[View as Markdown](https://developers.cloudflare.com/ruleset-engine/about/rulesets/index.md)|[Agent setup](https://developers.cloudflare.com/agent-setup/) A ruleset is an ordered set of [rules](https://developers.cloudflare.com/ruleset-engine/about/rules/) that you can apply to traffic on the Cloudflare global network. Rulesets belong to a phase and can only execute in the same phase. To deploy a ruleset to a phase, add a rule that executes the ruleset to the [phase entry point ruleset](https://developers.cloudflare.com/ruleset-engine/about/rulesets/#entry-point-ruleset). Rulesets are versioned. Each ruleset modification creates a new version of the ruleset. You can have several versions of a ruleset in use at the same time. When you deploy a ruleset — that is, when you create a rule that executes the ruleset — the most recent version of the ruleset is selected by default. There are several types of rulesets: * Phases have their entry point rulesets. * Cloudflare provides managed rulesets you can deploy. * You can create and manage your own custom rulesets. Specific Cloudflare products may provide other types of rulesets. ## Entry point ruleset An entry point ruleset contains a list of ordered [rules](https://developers.cloudflare.com/ruleset-engine/about/rules/) that run in a [phase](https://developers.cloudflare.com/ruleset-engine/about/phases/) at the account or zone level. This ruleset is an entry point for all rules executed in a phase. Some of these rules may run other rulesets. Each phase has at most one entry point ruleset at the account level and at the zone level. Note The `kind` field of a phase entry point ruleset has one of the following values: * `root` for a phase entry point ruleset at the account level * `zone` for a phase entry point ruleset at the zone level ## Managed rulesets Managed rulesets are preconfigured rulesets provided by Cloudflare that you can deploy to a phase. Only Cloudflare can modify these rulesets. The rules in a managed ruleset have a default action and status. However, you can define **overrides** that change these defaults. There are several Cloudflare products that provide you with managed rulesets. Check each product’s documentation for details on the available managed rulesets. For more information on deploying managed rulesets and defining overrides, refer to [Work with managed rulesets](https://developers.cloudflare.com/ruleset-engine/managed-rulesets/). ## Custom rulesets Note Currently, custom rulesets are only supported by the Cloudflare WAF. Use custom rulesets to define your own sets of rules. After creating a custom ruleset, deploy it to a phase by creating a rule that executes the ruleset. For more information on creating and deploying custom rulesets, refer to [Work with custom rulesets](https://developers.cloudflare.com/ruleset-engine/custom-rulesets/). Was this helpful? YesNo ## On this page [Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org","@type":"TechArticle","@id":"https://developers.cloudflare.com/ruleset-engine/about/rulesets/#page","headline":"Rulesets · Cloudflare Ruleset Engine docs","description":"How rulesets group and organize rules in the Ruleset Engine.","url":"https://developers.cloudflare.com/ruleset-engine/about/rulesets/","inLanguage":"en","image":"https://developers.cloudflare.com/og-docs.png","dateModified":"2026-04-16","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Deploy and customize managed rulesets provided by Cloudflare. title: Work with managed rulesets image: https://developers.cloudflare.com/og-docs.png --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/ruleset-engine/llms.txt > Use this file to discover all available pages before exploring further. # Work with managed rulesets Last updated Apr 16, 2026|Copy as Markdown|[View as Markdown](https://developers.cloudflare.com/ruleset-engine/managed-rulesets/index.md)|[Agent setup](https://developers.cloudflare.com/agent-setup/) Managed rulesets are preconfigured rulesets provided by Cloudflare that you can deploy. Only Cloudflare can modify these rulesets. The rules in a managed ruleset have a default configuration. However, you can define [overrides](https://developers.cloudflare.com/ruleset-engine/managed-rulesets/override-managed-ruleset/) that change this default configuration. Several Cloudflare products include managed rulesets: * [Web Application Firewall (WAF)](https://developers.cloudflare.com/waf/managed-rules/) * [DDoS Protection](https://developers.cloudflare.com/ddos-protection/managed-rulesets/) * [Cloudflare Network Firewall](https://developers.cloudflare.com/cloudflare-network-firewall/how-to/enable-managed-rulesets/) Check each product's documentation for details on the available managed rulesets. ## More resources To view available managed rulesets, refer to [View rulesets](https://developers.cloudflare.com/ruleset-engine/basic-operations/view-rulesets/). To deploy a managed ruleset to a phase, refer to [Deploy a managed ruleset](https://developers.cloudflare.com/ruleset-engine/managed-rulesets/deploy-managed-ruleset/). To adjust the behavior of a managed ruleset, do one of the following: * Customize the behavior of one or more rules by using [overrides](https://developers.cloudflare.com/ruleset-engine/managed-rulesets/override-managed-ruleset/). * Skip one or more managed rules by adding [exceptions](https://developers.cloudflare.com/ruleset-engine/managed-rulesets/create-exception/). Exceptions (only supported by the WAF) have priority over overrides. Was this helpful? YesNo ## On this page [Docs](https://developers.cloudflare.com/) ```json {"@context":"https://schema.org","@type":"WebPage","@id":"https://developers.cloudflare.com/ruleset-engine/managed-rulesets/#page","headline":"Work with managed rulesets · Cloudflare Ruleset Engine docs","description":"Deploy and customize managed rulesets provided by Cloudflare.","url":"https://developers.cloudflare.com/ruleset-engine/managed-rulesets/","inLanguage":"en","image":"https://developers.cloudflare.com/og-docs.png","dateModified":"2026-04-16","publisher":{"@type":"Organization","name":"Cloudflare","url":"https://www.cloudflare.com/"},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"}} ``` --- --- description: Create an exception to skip specific rules or rulesets. title: Create an exception image: https://developers.cloudflare.com/og-docs.png --- [Skip to content](#main-content) > Documentation Index > Fetch the complete documentation index at: https://developers.cloudflare.com/ruleset-engine/llms.txt > Use this file to discover all available pages before exploring further. # Create an exception Last updated Apr 16, 2026|Copy as Markdown|[View as Markdown](https://developers.cloudflare.com/ruleset-engine/managed-rulesets/create-exception/index.md)|[Agent setup](https://developers.cloudflare.com/agent-setup/) Use [exceptions](https://developers.cloudflare.com/waf/managed-rules/waf-exceptions/) to skip the execution of a managed ruleset of some of its rules. The exception configuration includes an [expression](https://developers.cloudflare.com/ruleset-engine/rules-language/expressions/) that defines the skip conditions, and the rules or managed rulesets to skip under those conditions. If you are using Terraform, refer to [Configure exceptions](https://developers.cloudflare.com/terraform/additional-configurations/waf-managed-rulesets/#configure-exceptions) in the Terraform documentation. If you are using the Cloudflare dashboard, refer to [Add an exception in the dashboard](https://developers.cloudflare.com/waf/managed-rules/waf-exceptions/define-dashboard/). Note Currently, only the [Cloudflare Web Application Firewall (WAF)](https://developers.cloudflare.com/waf/managed-rules/waf-exceptions/) supports managed rules exceptions. ## Types of exceptions An exception can have one of the following behaviors (from highest to lowest priority): * [Skip all remaining rules in the entry point ruleset](#skip-all-remaining-rules) * [Skip one or more managed rulesets](#skip-one-or-more-managed-rulesets) * [Skip one or more rules of managed rulesets](#skip-one-or-more-rules-of-managed-rulesets) You define exceptions in a given context — zone level or account level — and they apply only to that context. For example, if you define an exception that skips all remaining rules at the account level, the rules defined in the entry point ruleset at the zone level will still be evaluated. If there is a match for the expressions of several exceptions, Cloudflare will consider the exception with the highest priority. Exceptions only apply to rules executing a managed ruleset listed after them. If you add an exception at the end of the list of rules of an entry point ruleset, nothing will be skipped. Additional requirement for account-level exceptions Rules in entry point rulesets at the account level only apply to Enterprise zones. This also includes exceptions (or skip rules). When adding an exception at the account level, you must use parentheses to enclose any custom conditions in the rule expression and end the
…