// Managed Rules · Custom Rules · Rate Limiting Rules — all on one domain
// Rules run at Cloudflare's edge before this Worker ever sees the request
Three layers of protection. One dashboard. Zero origin code.
Cloudflare writes the rules. You click deploy. No WAF specialists, no rule-tuning marathons.
// rulesets active: Cloudflare Managed · OWASP Core (PL2) · Exposed Credentials Check
?q=<script>alert(1)</script>?id=1' OR '1'='1POST /login (breached pwd)// Blocks return Cloudflare's default block page. The credential-stuffing request reaches the Worker (always 401) but is logged in Security Events.
Your security policy, your rules. Block, challenge, or allow based on anything in the request — no backend changes required.
// rules active: Scraper & pentest UA block · Admin challenge · API key enforcement · Bot fingerprint block
User-Agent: sqlmap/1.7GET /adminGET /api/data (no x-api-key)cf.bot_management.score ≤ 30// All Custom Rules are scoped to http.host eq "security.nobledemos.com" — the rest of the zone is untouched.
curl from your laptop won't trigger this rule
Bot Management scores every request 1–99 (1 = automated, 99 = human). The score comes from JA3/JA4 TLS fingerprints, HTTP/2 frame patterns, IP reputation, and behavioral signals — not the User-Agent. Spoofing -A "BadScraper" changes nothing.
A plain curl from your laptop typically scores 30–60: residential IP with clean reputation, plus a TLS handshake that looks similar enough to common dev tooling. It clears the ≤ 30 threshold.
Run it from GCP Cloud Shell instead. Three signals collapse the score to 1:
curl links against a TLS library whose JA4 matches a known automation signature (you'll see "Python - TLS Signature" in Security Events)__cf_bm session, no behavioral history, no JS challenge passedBot score 1 → blocked with 403. Open the rule in the dashboard, then copy the Cloud Shell URL and run the curl above to see it fire.
Count what matters — per IP, per user, per API key, per country. Stop abuse without punishing your real customers.
// rules active: Brute-force login protection · Per-API-key quota
POST /login · per IPGET /api/data · per x-api-keyNot every suspicious request should be blocked outright. Sometimes the right answer is "prove you're human." Cloudflare runs the challenge at the edge — your origin only sees verified visitors.
action: Managed Challenge
when: path eq /managed-challenge
action: Interactive Challenge
when: path eq /interactive-challenge
// rules active on challenge-endpoint.nobledemos.com: /managed-challenge → managed_challenge · /interactive-challenge → interactive_challenge
Here's what attack.sh does. Every request prints a single colored line — and every block, challenge, and 429 shows up in the Security Events view in the dashboard in real time.
# run against all three pillars in sequence curl -sSL https://security.nobledemos.com/attack.sh | bash -s -- all # or target one pillar at a time curl -sSL https://security.nobledemos.com/attack.sh | bash -s -- managed curl -sSL https://security.nobledemos.com/attack.sh | bash -s -- custom curl -sSL https://security.nobledemos.com/attack.sh | bash -s -- ratelimit # or download, inspect, and run curl -O https://security.nobledemos.com/attack.sh chmod +x attack.sh ./attack.sh all
// Dependencies: bash + curl. No Python, no npm. Safe to run on your laptop — every request targets this demo domain only.