ls /demos
a running catalog of live endpoints on this domain, organized by cloudflare product area. built incrementally — anything not marked live is on the shortlist and will land here as it's built.
# zero trust / cloudflare one
GET /admin live
access-protected route. reach it from an unauthorized session and you'll be sent to the configured idp. once through, the page reflects your access identity back to you.
gateway http policy trigger coming soon
endpoints that pair with a gateway http policy to demo block / isolate / override actions end-to-end.
dlp inspection target coming soon
endpoints returning synthetic pii-shaped strings so dlp detectors have something to catch on egress.
warp / posture reflection coming soon
a route that surfaces what warp + device posture are (or aren't) telling cloudflare about the request.
# application services / waf
waf: custom rule block live
button-triggered edge block. custom branded 403 response. curl equivalent shown on the page.
waf: managed + interactive challenge live
both challenge flavors, one page. see the difference between "cloudflare picks" and "always require a click".
waf: user-agent / header block live
three ways to trigger: curl, devtools override, in-page fetch. shows why edge validation beats client trust.
rate limiting live
hammer button fires 20 requests; watch requests 11+ come back as 429 from the edge.
rate limit by header live
advanced rate limiting counting by x-user-id. each user id has its own bucket.
sensitive data detection live
synthetic pii on two path prefixes: one logged, one blocked. sdd inspects response bodies at egress.
managed rulesets (owasp) live
three buttons: safe / xss / sqli. cloudflare managed + owasp core block the malicious payloads at the edge.
geo block live
waf custom rule blocking US ips. dynamic message names your country. hop on a vpn to see the difference.
block ai scrapers live
waf custom rule matching gptbot / claudebot / perplexitybot. curl + in-browser fetch demos.
branded error pages live
401 / 403 / 404 / 429 in matching aesthetic. some served by pages, some by cloudflare's edge.
page shield live
loads a third-party script so page shield has something to see. covers script inventory + csp recommendation.
api shield: schema + jwt live
schema validation (uuid enforcement) + jwt validation (rs256 with jwks). both enforced at cloudflare's edge.
# cache / cdn
cache MISS → HIT live
watch cf-cache-status flip from MISS to HIT across three back-to-back requests.
purge by cache-tag live
warm the cache, purge tag SITE_cache_purge_demo from the dashboard, refresh to see new value.
per-path cache TTL live
two endpoints, two rules: 1s vs 24h. side-by-side proof that cache rules are per-path.
# developer platform
kv counter live
workers kv storing a single global counter. eventually consistent.
d1 guestbook live
sqlite-backed guestbook. turnstile-gated. auto-purged 2x daily by cron worker.
durable objects live viewers live
every open tab holds a websocket to one durable object. count broadcasts in real time.
queues (producer + consumer) live
pages function enqueues, separate worker consumes async, result surfaces via polling.
workflows live
durable multi-step workflow with sleeps. checkpointed, survives worker restarts.
ai chat live
llama-3.3-70b via ai gateway. turnstile + rate limit + system prompt guardrails.
ai gateway explainer live
what ai gateway does behind /ai-chat. rate limits, caching, logs, fallback.
vectorize semantic search live
24-doc corpus. embed query, cosine-nn search, return top 5. built on workers ai + vectorize.
# load balancing
origin failover live
two workers as origins, one lb, one health monitor. disable a pool origin and watch traffic flip to the fallback pool.
geo steering live
same lb, region_pools map. na → pool-a. everywhere else → pool-b. vpn-test to see the flip.
# bots + humans
bot score reflection live
echoes cloudflare's bot management signals for your request. compare browser vs curl.
turnstile widget live
contact-form-shaped page with a turnstile challenge. server-side siteverify before accepting.
# developer platform
workers ai inference coming soon
a small worker calling workers ai to demo llm inference running at the edge.
d1 + kv sample coming soon
a route backed by d1 and kv to show how storage primitives look from the pages / worker side.
durable objects counter coming soon
a classic stateful counter demo to make durable objects feel concrete.
queues + workflows coming soon
a small pipeline demonstrating how to fan work out over queues and coordinate multi-step jobs with workflows.
# ai
ai gateway proxy coming soon
a route that proxies through ai gateway to demonstrate caching, analytics, and guardrails on outbound ai calls.
vectorize search coming soon
a tiny semantic-search endpoint backed by vectorize + workers ai embeddings.
# network services / magic
magic wan reachability coming soon
reference material on how magic wan connects sites and how policy flows through magic firewall.
tunnel private network coming soon
a private hostname reachable only via cloudflare tunnel + warp — a working example of the private-app pattern.
# observability
dex synthetic target coming soon
a lightweight, dependable endpoint intended to be used as a target for digital experience monitoring tests.
logs / analytics demo coming soon
a route paired with logpush / analytics engine samples so you can see the full observability picture.