To conform to recommended best practices for using the OWASP Core Rule Set, the order of WAF rule processing has been changed so that custom rule files added by the user are now processed before the OWASP CRS rules. In previous releases, the OWASP rules were processed first.