---
layout: article
title: Priority
description: Learn how Appwrite Firewall evaluates rules by priority and first-match behavior.
---

**Priority** sets the order Appwrite evaluates rules in. Lower numbers run first. The first rule that matches applies its [action](/docs/products/firewall/actions), and no later rule runs for that request.

Priority ranges from `-100000` to `100000`. The Console's stepper stops at `0`, so type a negative number to go below it.

# How evaluation works

1. Appwrite loads **enabled** rules for the project, ordered by priority ascending (for example `10` before `100`).
2. Appwrite skips rules that do not apply to the request's [resource type](/docs/products/firewall/scopes).
3. For each remaining rule in order, Appwrite checks whether all [conditions](/docs/products/firewall/conditions) match.
4. On the first match, the rule action runs (deny, bypass, challenge, rate limit, or redirect).
5. Appwrite ignores later rules for that request.

If no rule matches, the request continues.

**Stop on match**

**Bypass** stops evaluation, and so does **rate limit** while the request is under the quota. Neither lets a later deny rule run.

One case is different. A rate limit rule with **Limit by** set to `userId` cannot apply to a signed-out visitor, so Appwrite skips it and continues to the rules below.

# Choosing priority values

The Console create wizard defaults priority to `100`, while the API defaults to `0` when you omit the parameter. Common patterns:

| Pattern | Approach |
|---------|----------|
| Allowlist then deny | Bypass at `10`, deny at `100` |
| Tight path before broad rate limit | Path-specific deny at `20`, broad rate limit at `200` |
| Temporary override | Insert a new rule at a lower number than existing policies |
| [Attack mode](/docs/products/firewall/attack-mode) on a site | Catch-all challenge at `0`. Bypass allowlists must use a **negative** priority to run first |

Leave gaps between priorities (for example `10`, `20`, `30`) so you can insert rules later without renumbering everything.

To change a rule's priority, open its actions menu in the rules list and choose **Update**. The change applies to new requests within moments.

[Allowlist trusted IP addresses](/docs/products/firewall/allowlist-ips)