Before the router with runPreRoutingFilters() to modify parsed request data to be able to select different routers.

After the router has run, but before the controller has been selected with runRequestFilters() (example: password protecting parts of the site).

After the controller/action has run, but before the view is applied with runResultFilters() (example: adding common variables to be used in views, such as INI settings).

After the view has run, but before the request writer writes output with runResponseFilters() (example: gzipping HTTP content on the fly).