demo: waf custom rule → block

this page loads normally. a cloudflare waf custom rule is watching for a specific query parameter. hit the button (or reload the url with that parameter) and the request never reaches this page. cloudflare responds with a branded block response at the edge.

# trigger it (browser)

click below. the page will navigate to ?trigger=please and cloudflare will intercept.

block me now

# trigger it (curl)

curl -i "https://rhocfsandbox.com/waf-block-me?trigger=please"

expected response: HTTP/2 403 with the branded block html. the cf-ray and cf-mitigated headers confirm which rule fired.

# what's the rule

ruleset	zone → security → waf → custom rules
rule name	`SITE_waf_block_me`
expression	`http.request.uri.path eq "/waf-block-me" and http.request.uri.query contains "trigger=please"`
action	block · custom html response (403)