Cloudflare Snippets are executed based on rules defined within your zone. Here is how the process works:
For each incoming request, Cloudflare evaluates the expression of every snippet rule defined in the zone. The evaluation checks for a match based on various request properties (such as bot score, WAF attack score, country of origin, and cookies).
For every snippet rule in a zone that matches an incoming request, Cloudflare adds the corresponding unique snippet ID to a Snippets table.
Once all the rules have been evaluated and the full table has been compiled, Cloudflare starts processing all the snippet IDs in the table.
The snippets are executed sequentially. Each snippet receives the modified request from the previous snippet and applies new modifications to it.
After executing the final snippet IDs, the resulting modified request is passed back to the request execution workflow. Refer to Execution order for more information on the Rules features evaluated before and after Cloudflare Snippets.
When a snippet calls fetch() to a proxied hostname in the same zone, the request that the snippet makes is a subrequest. The incoming request that triggered the snippet is evaluated as normal, including by the security features configured for the hostname the visitor requested.
WAF custom rules and WAF managed rules on the target hostname are not evaluated for a same-zone subrequest made by a snippet. This applies to both fetch(url) and fetch(request).