Protection before the application
Filter malicious requests before they put load on your server. WAF, rate limiting and bot detection add layers of protection for websites and APIs.
Try Cloudflare live
Explore how Cloudflare protects applications, controls access and processes requests. The demos run on our Cloudflare infrastructure. Choose a test or ask the AI assistant.
Ask about Cloudflare
Start with what your business needs. The AI assistant can explain the platform’s capabilities and the demos on this page.
An assistant ready for your questions
Explore how WAF, access without a VPN or managed Cloudflare work. The assistant uses Llama 3.3 on Workers AI and follows the context of your conversation.
AI can make mistakes. For a concrete plan for your site, talk to our team.
What would you like to ask?
Pick a question or write your own.
Limited to 6 messages per minute and 25 per conversation. Complete the verification before your first message.
What this means
for your business
More secure applications, controlled access and room to build. Explore the technologies that can support your next stage of growth.
Access under your control
Give authorized people access to internal tools. Cloudflare Access verifies their identity before they enter the application.
Development without server management
Run code on Cloudflare’s network and store data in D1. Your team can focus on the application while Cloudflare manages the infrastructure.
What you can try here
Choose an area to explore. Its demos will open in the interactive section below.
Demo playground
Send requests and explore the results. Switch between categories without losing your demo progress.
Application security
you can watch working
Firewall, rate limiting and bot detection. Every card sends real requests to our demo application.
Stop an attack before it reaches the application
Compare a normal request with a test attack and see how the configured web application firewall (WAF) rule responds.
- Send a clean requestIt passes through Cloudflare to the application and returns 200 OK.
- Run a test attackCloudflare stops it at the edge with a 403 before it ever reaches the application.
Why it matters
The malicious request ends on the Cloudflare network. Your server never sees it.
- Your browser
- Cloudflare WAF
- Demo application
Waiting for your request. Start with a clean one.
Change the test attack type
Requests only go to our own demo application.
Test the request limit
This demo is configured for 5 requests per 10 seconds. Send 12 and watch for Cloudflare to reject further requests with a 429 response.
0 requests in the last 10 s (limit 5)
Results will appear after you send requests.
Why it matters
The same kind of rule protects logins, forms or APIs from floods and password guessing.
Why don't the 429s start right away?
Counting is distributed across the edge, so the first burst may run a little over the limit before 429s begin. Wait 10 seconds and it resets. Clearing the results does not reset the limit on the server.
Your bot score
Bot score estimates whether a request comes from a person or automation. Lower scores suggest automation; higher scores, up to 99, suggest a human visitor.
…/ 99
Loading your request score…
Why it matters
Use the score to configure rules that block or challenge suspicious requests.
Technical request details
| Network (ASN) | … |
|---|---|
| Edge PoP | … |
| JA4 fingerprint | … |
| User agent | … |
Compare your browser’s result with a request sent using a tool such as curl. The score depends on several signals and may vary.
Applications protected by identity checks
The demo Integrity Partner Portal is protected by Cloudflare Access. It checks your identity and permissions before allowing entry. You only need a browser to sign in.
Internal tools, staging sites and admin panels get identity checks at the edge, not on your server
Policies by e-mail domain, identity provider, device or country
Works with your existing SSO, or with one-time e-mail codes for external guests
Staff reach every internal app through one App Launcher
The portal requires approved access. To explore the application after signing in, contact our team.
How access verification works
- You open the portalThe request heads for the Integrity Partner Portal.
- Cloudflare Access checks your identityAt the edge, before the request reaches the application.
- The application receives a signed tokenOnly users who meet the access policies can enter the application.
Code and data
running at the edge
This page's backend is a Cloudflare Worker with a D1 database. See where it answers you from and write your own note to the database.
Where does the response come from?
A Cloudflare Worker processes your request and reads data from D1. See which data center handled the request and the measured response timings.
| Data center | … |
|---|---|
| Serving your location | … |
| Protocol | … |
| D1 database read | … |
| Worker execution | … |
Why it matters
Your code runs on Cloudflare’s network. The platform manages the servers.
Try a database write
Write a note and see it saved to D1 after a Turnstile verification. Your name, company and note will be publicly visible.
SQL queries used in this demo
SELECT name, company, message, colo, created_at FROM guestbook ORDER BY id DESC LIMIT 20; INSERT INTO guestbook (name, company, message, colo) VALUES (?1, ?2, ?3, ?4); SELECT COUNT(*) AS total, COUNT(DISTINCT colo) AS distinctColos FROM guestbook;
Take the next step with Cloudflare
You have seen how Cloudflare works. Together, we can identify which capabilities will help your website, applications and team.