Demo story
Show edge protection without changing app code
Use the buttons below to generate traffic from the browser UI. Then show Cloudflare Dashboard → Security → Events to prove which rule matched and what action was taken.
1. Normal traffic
Visitors load the static website normally.
2. WAF controls
Cloudflare blocks or challenges specific requests by URL, query, path, country, IP, ASN, headers, bot score, and more.
3. Visibility
Security Events shows source, path, Ray ID, rule name, and action.
Browser-only demo
Trigger AppSec scenarios from this UI
Create the Cloudflare rules in the next section first. Then return here and click the buttons. No terminal needed during the live demo.
Custom WAF block
Triggers a safe query string for a custom WAF rule.
Expected: Cloudflare block page
Managed Challenge
Triggers a challenge rule. Useful to show a less aggressive mitigation than block.
Expected: Managed Challenge
Admin path protection
Simulates protecting sensitive paths, even if the origin is simple static content.
Expected: Block or Challenge
Managed WAF payload samples
These URLs contain harmless demo strings that look like common attacks.
Expected: event if managed rules are enabled
Rate limit burst from the browser
Generates repeated requests to the same URL. Create the rate limiting rule below first.
Cloudflare setup
Rules to create in the Cloudflare UI
Rule A — Block demo query
Dashboard: Security → WAF → Custom rules → Create rule
Rule name: Demo - Block safe query
Expression:
(http.host in {"tasniime.com" "www.tasniime.com"} and http.request.uri.query contains "cf_demo=waf-block")
Action: Block
Rule B — Challenge demo query
Dashboard: Security → WAF → Custom rules → Create rule
Rule name: Demo - Managed challenge
Expression:
(http.host in {"tasniime.com" "www.tasniime.com"} and http.request.uri.query contains "cf_demo=challenge")
Action: Managed Challenge
Rule C — Protect admin path
Dashboard: Security → WAF → Custom rules → Create rule
Rule name: Demo - Protect admin
Expression:
(http.host in {"tasniime.com" "www.tasniime.com"} and starts_with(http.request.uri.path, "/admin"))
Action: Block or Managed Challenge
Rule D — Rate limit browser burst
Dashboard: Security → WAF → Rate limiting rules → Create rule
Rule name: Demo - Browser burst rate limit
Expression:
(http.host in {"tasniime.com" "www.tasniime.com"} and http.request.uri.query contains "cf_demo=rate-limit")
Requests: 8
Period: 10 seconds
Mitigation: Block or Managed Challenge
Mitigation timeout: 1 minute
Characteristics: IP
Optional — Managed WAF rules
Dashboard: Security → WAF → Managed rules. Enable Cloudflare Managed Ruleset and OWASP Core Ruleset. Then try the XSS-style and SQLi-style buttons.
What to show live
Security Events talking points
- Open Security → Events in the Cloudflare dashboard.
- Filter by hostname:
tasniime.com. - Click an event and show: Ray ID, source IP/country, path, rule name, action, and matched expression.
- Explain: the VM is unchanged; enforcement happened at Cloudflare's edge.
Talk track
“This is a simple static site, but Cloudflare lets us add application security controls without deploying new code. We can block known-bad patterns, challenge suspicious traffic, rate-limit abuse, and investigate everything from Security Events.”
Cleanup after demo
Disable or delete demo rules if you do not want visitors blocked by the sample URLs. Keep HTTPS and normal WAF protections enabled.
Contact
Tasnime Hamdi — Virtual Solutions Engineer
Hosted on a Debian VM. Protected by Cloudflare.