WAF policy custom rules performance and processing load impact

Question

https://learn.microsoft.com/en-au/answers/questions/2105310/waf-rule-processing-load-and-its-impact-analysis

This question mentioned that individual custom rule does have very slight delay.

Currently we have a single regex rule as very first rule and everything that's contain exact string match are beneath this rule.

So, first rule is regex to filtering (<pattern_1>|<pattern_2>|<pattern_3>|<pattern_4>|<pattern_5>).

Many rules afters that do "Contains" match on Request URI String type.

Any idea if the ordering of the rules would potentially impact filtering performance? e.g. Recommended regex rule at beginning or end?

Answer 1

Hi Terii,

Yes, ordering can affect how much rule processing happens.

Azure WAF evaluates custom rules by priority, with lower numbers first. If a rule matches with an Allow or Block action, evaluation stops. A Log rule continues to the next rule.

For your case, I would generally recommend:

Put simple and frequently matched Contains, Equal, or BeginsWith rules earlier.

Keep the broader regex rule later if most requests will not match it.

If the regex rule is expected to match and block a large percentage of requests, keeping it first can actually reduce overall processing because WAF stops immediately after the match.

So there is no rule that regex must always be first or last. Order rules based on how often they match and whether the action terminates processing.

The latency difference per rule is normally very small, but with high request volume and many custom rules it is still worth optimizing and validating with your actual traffic. Microsoft also recommends testing this against your workload.

For the pattern you described, I would normally put the specific Contains rules first and the combined regex afterward, unless that regex is your main high-volume blocking rule.