See Cloudflare working, live
Every card on this page talks to real Cloudflare infrastructure: a real WAF, real rate limiting, a real database at the edge. Nothing here is simulated. Built and run by our team on Cloudflare Workers, Workers AI, D1, Access and Turnstile.
WAF, rate limiting and bot detection
Trigger the WAF
A firewall rule on this endpoint blocks injection-style payloads. Send a clean request, then a malicious one, and watch the difference.
Pick a payload and fire it. Cloudflare stops it at the edge with a 403 before it ever reaches the application. The clean request passes.
Hit the rate limit
This endpoint allows 5 requests per 10 seconds per visitor. Fire a burst of 12 and watch Cloudflare start refusing with 429.
0 requests in the last 10 s (limit 5)
Counting is distributed across the edge, so the first burst may run a little over the limit before 429s begin. Wait 10 seconds and it resets.
Your bot score
Cloudflare scores every request from 1 (definitely automated) to 99 (definitely human) using ML trained on the traffic of millions of sites.
| Verdict | ... |
|---|---|
| Network (ASN) | ... |
| Edge PoP | ... |
| JA4 fingerprint | ... |
| User agent | ... |
Curl this same endpoint from a terminal and you will score 1. Your browser should do considerably better.
An application with no VPN and no public door
The login wall is the demo
Our mock internal tool, the Integrity Partner Portal, sits behind Cloudflare Access. When you open it, Cloudflare checks your identity at the edge, before a single request reaches the application. No VPN client, no exposed origin.
Visitors without an approved identity stop at the wall. Approved identities pass and see the decoded, cryptographically signed identity token that Cloudflare attaches to every request.
You will meet a real Cloudflare Access login. That is the point. Want to see what is behind it? Ask us for a demo session.
Why it matters
- Internal tools, staging sites and admin panels get identity checks at the edge, not on your server
- Policies by e-mail domain, identity provider, device or country
- Every request carries a signed identity token your application can verify
- Works with your existing SSO, or with one-time e-mail codes for external guests
- Staff reach every internal app through one App Launcher, no bookmarks to leak
Code and data running at the edge
Where is this page's backend right now?
This card is answered by a Cloudflare Worker, serverless code running in the data center nearest to you, reading from a D1 database.
| Data center | ... |
|---|---|
| Serving your location | ... |
| Protocol | ... |
| D1 database read | ... |
| Worker execution | ... |
Edge guestbook
Writes go through Turnstile (Cloudflare's invisible CAPTCHA replacement) into a D1 database at the edge. Leave a note.
The SQL running at the edge
An assistant running on edge GPUs
Ask about Cloudflare, the demos on this page, or our services. The assistant is itself a demo: Llama 3.3 70B running on Cloudflare Workers AI through AI Gateway, with its conversation memory in a D1 database.
Limited to 6 messages per minute and 25 per conversation. Complete the verification before your first message.