Enterprise Security Capability Demo 🛡️
This site runs behind a Cloudflare Enterprise demo zone. Each scenario below is driven by native edge rules (WAF / Rate Limiting / Cache / Waiting Room) — the pages themselves are just static origin content being protected.
How to watch: open a scenario → press F12 → Network → inspect the response headers (CF-Ray, cf-cache-status).
Enterprise Zone WAF Custom Rules Waiting Room Cache
Demo scenarios
① Baseline — Allow
No rule matches this path; it serves normally as the control baseline.
② WAF Block — custom 403
A WAF Custom Rule executes Block on this path and returns a branded 403 page.
③ Managed Challenge
Rule action Managed Challenge: Cloudflare decides the right level of verification — humans pass with almost no friction, bots get stuck.
④ JS Challenge
Rule action JS Challenge: a browser check runs first, then the request is released (great for low-confidence bot screening).
⑤ Log-only (observe)
Rule action Log: log matches without blocking, for zero-risk rollouts. Enterprise-only.
⑥ Rate Limiting → 429
Rate limiting rule: more than the threshold from one IP in 10s → custom 429 page, blocked for 60s.
⑦ Waiting Room queue
Enterprise waiting room: use the Queue-all toggle to force every visitor into the queue, then release them FIFO.
⑧ Cache HIT / MISS
A Cache Rule sets Cache Everything on this path; the page reads cf-cache-status live.
Pre-demo config checklist (see README.md)
| # | Configuration | Scenarios |
|---|---|---|
| 1 | nc-demo.cf zone DNS → OpenResty origin (oldm / wrdm A records, proxied) | All |
| 2 | Custom Errors: upload managed-challenge.html / js-challenge.html | ③④ |
| 3 | WAF Custom Rules by path: Block / Managed / JS / Log | ②③④⑤ |
| 4 | Rate Limiting rule: /demo/ratelimit.html | ⑥ |
| 5 | Cache Rule: /demo/cache/* Cache Everything 300s | ⑧ |
| 6 | Waiting Room on wrdm.nc-demo.cf (Queue-all demo) | ⑦ |