Operations that skip validation rule enforcement
Key Takeaway
By default, validation rules run on changes from page layouts and API calls, but a few operations skip them, such as Quick Create, the Mass Transfer tool and workflow rule field updates.
Validation rules check new and updated records before they save, and they block the save when the formula returns True. A few operations save records without running these rules. When you know these exceptions, you know when a rule will not protect your data and what to do about it.
What validation rules apply to by default
By default, validation rules apply to new and updated records for an object, whether the change comes from a page layout or an API call. They apply even when the fields the rule references are not on the page layout or in the API call.
Validation rules check integrations too, so verify that each rule works for every page layout and every integration that uses the object.
Web-to-Lead and Web-to-Case are not exceptions. Salesforce runs validation rules before it creates these records, and it creates only the records that have valid values.