How WAF rules and attack challenge work together

Easel offers two ways to run a browser proof-of-work (PoW) checkpoint at the edge:

1. Custom Web Application Firewall (WAF) rules: targeted. You define who matches (paths, headers, cookies, and so on) and set Challenge only for that traffic.
2. Attack challenge mode: project-wide. When enabled, all normal browser traffic for the project is challenged (with exceptions below).

Both flows share the same verification endpoint and session cookie model after a successful solve.

Order of operations

Traffic passes through edge protections in a fixed order. In simplified terms:

• Custom WAF rules run before Attack challenge mode applies to a request.
• If a Custom WAF rule matches with Challenge, the visitor may complete PoW before site-wide attack mode is evaluated for that request path (and the session cookie can satisfy later checks).
• If Attack challenge mode is off, only Custom WAF (and other edge policies) apply.

Exact internal stages may evolve. The important product fact: your rules run before the project-wide challenge toggle.

Bypass attack challenge

The Bypass attack challenge action means: for requests that match this rule, the edge skips Attack challenge mode for that request.

It does not:

• Skip Custom WAF rules that appear above this rule in the list (ordering still matters).
• Disable Deny, Redirect, or Challenge actions in other rules.
• Skip other platform protections outside Attack challenge mode.

Use Bypass when you need a known-good slice of traffic (for example, specific paths or headers) to always reach the app while Attack challenge mode stays on for everyone else.

Verified bots

When Attack challenge mode is on, Easel can allow verified bots (for example major search crawlers) without PoW, depending on your Allow verified bots setting in Attack challenge mode.

Custom WAF evaluation still applies first. If a Challenge rule matches a verified bot, that rule’s Challenge still applies unless your conditions exclude bots.

When attack challenge mode is off

If Attack challenge mode is off and you only use Custom WAF:

• Challenge rules still issue the PoW flow for matching traffic.
• Bypass attack challenge has no effect (there is no site-wide challenge to bypass).

Firewall observability

• Challenge (from WAF or attack mode) shows in firewall-style metrics as edge challenge activity.
• Successful or failed POSTs to the verify endpoint surface as challenge pass and challenge fail in the same family of charts where firewall actions are grouped.

Related guides

• Custom WAF rules: conditions, actions, ordering, and limitations
• Troubleshooting: 403 and challenge symptoms