Scenario ④ · WAF action = JS Challenge
🤖 You are seeing this page = the JS Challenge rule is not active
When configured, this URL (https://oldm.nc-demo.cf/demo/js.html)
first shows the "Checking your browser" interstitial (custom page you uploaded), runs a
JavaScript proof, then releases the request automatically.
Difference from Managed Challenge
| JS Challenge | Managed Challenge |
|---|---|
| Always shows the "checking browser" interstitial | Decides per-request: interstitial, silent verification, or nothing |
| For high-confidence bot screening | For general human/bot traffic with best UX |
Audience demo
- WAF → Custom rules: match URI Path contains "/demo/js.html" → action JS Challenge.
- Browser → interstitial "Checking your browser…" → auto-continues after a few seconds.
- curl -I https://oldm.nc-demo.cf/demo/js.html → blocked (no 2xx), because curl cannot run JavaScript.