Cloudflare evaluates different rule products in defined phases. Within a phase, terminating actions and settings changes follow different rules, so moving one row visually is not always enough to resolve a conflict.
IN THIS ARTICLE
Gather the details you will need
Collect the exact request URL, method and relevant headers. List the redirects, rewrites, cache rules, security controls and Workers that may affect it, with their current order.
01 Diagnose overlapping Cloudflare rules
- Use Cloudflare Trace where available to inspect how the example request matches supported rules. Compare the trace with a real request because not every product or runtime outcome is simulated.
- Check whether an earlier redirect, block or challenge terminates processing before the rule you expected.
- For overlapping Cache Rules, remember that matching settings combine and a later conflicting setting can override an earlier one. Place private-content bypass behaviour deliberately.
- For URL rewrites, inspect the transformed fields seen by later phases rather than assuming every rule sees the original path.
- Change the smallest relevant expression or order, then retest matching and nonmatching requests and retain the result with the configuration record.
02 Example: find an account-page bypass overridden by a later rule
Consider a faulty test configuration in which the same request matches both cache rules below. The first rule does not automatically win just because its purpose is to protect private pages.
| Order | Matching setting |
|---|---|
| Earlier rule | Bypass cache for the account path on the selected hostname. |
| Later rule | Make every path on that hostname eligible for cache. |
A later conflicting cache setting can override the earlier setting. Narrow the public rule to verified public assets and review the final effective bypass for private content. Use Trace where supported, then test the real account path with two isolated test sessions and a public asset that should remain cacheable.
Expected result: private responses stay outside shared caching and the unrelated asset follows its public policy. This is a Cache Rules example, not a universal first-match or last-match rule for every Cloudflare product.
Confirm the expected result
The observed response should follow one coherent rule path, with no accidental bypass or redirect loop. Validate both the successful case and a nearby URL that should remain unaffected.
If the problem continues
Legacy Page Rules and modern Rules products do not share a simple universal first-match model. A Single Redirect can terminate before a Bulk Redirect is reached. Review the current product execution order for the specific conflict.
Does the first matching rule always win?
No. A terminating action stops processing, while nonterminating settings can be changed later in the same phase. The answer depends on the product and action involved.