Why Cloudflare rule order matters?

Before jumping into this article please take a look at the following Cloudflare ruleset and think for a while what is wrong with it? I set up above rules and thought they would work like the following: From the first glance it seems perfectly fine. Website administrator wants to challenge users opening the website to prevent bot traffic. Additionally he specifies a rule that blocks access to…