demo: waf custom rule → challenge

two flavors of challenge, both configured as waf custom rules on this exact path. hit either button and cloudflare will interrupt with its challenge ui before letting you back through. challenge ui is served by cloudflare's edge, not by this site.

# managed challenge

cloudflare picks the right challenge for the visitor's risk profile: often invisible, sometimes a click, rarely interactive. most humans breeze through.

# interactive challenge

always requires a user gesture (click, hold, or drag). used when you want strong human-presence signal — for example, protecting a login or checkout page.

# curl (for the terminal humans)

curl -i "https://rhocfsandbox.com/waf-challenges?challenge=managed"
curl -i "https://rhocfsandbox.com/waf-challenges?challenge=interactive"

from curl you'll get the challenge html back (status 403 with cf-mitigated: challenge). curl can't solve it — challenges need a real browser. that's the point.

# what's the rule