Cloudflare Demo

Interactive demonstrations of Cloudflare features running on this origin. Each section showcases a different capability with live tests, response inspection, and copy-paste curl commands.

01

Cache Inspector

Fetch assets through Cloudflare and inspect caching behaviour. Click ▶ on any result to expand full response headers.

Asset Status Cache RTT Size Age Content-Type CF-Ray PoP
No results yet. Click an asset or Fetch All to begin.
Cache Status Reference
HIT Served from Cloudflare edge cache
MISS Fetched from origin, now cached at edge
EXPIRED Cached copy was stale, re-validated with origin
REVALIDATED Stale cache confirmed still valid (304)
DYNAMIC Not cached — Cloudflare only caches static file extensions by default. JSON and other dynamic responses are passed through without being stored at the edge.
BYPASS Cache deliberately skipped by a cache rule
02

Image Transformations

Cloudflare resizes, reformats, and compresses images on-the-fly at the edge using a special URL prefix: /cdn-cgi/image/<options>/<source>. No origin-side code required.

85
/cdn-cgi/image/width=600,format=auto,quality=85/gallery/aurora-borealis.jpg
03

Browser Integrity Check (BIC)

BIC is enabled on /shop/*. Cloudflare inspects the User-Agent header and blocks bots with a 403 before the request reaches the origin.

Blocked

Empty User-Agent

No UA header — BIC rejects this with a 403.

curl -v -A "" https://<domain>/shop
Blocked

Known bad bot UA

A scanner signature that BIC recognises as malicious.

curl -v -A "masscan/1.0" https://<domain>/shop
Passes

Normal browser UA

A standard browser User-Agent passes BIC and reaches the origin.

curl -v -A "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" \
  https://<domain>/shop

Blocked requests appear in Security → Events in the Cloudflare dashboard, filtered by action Block and source BIC.

04

Rocket Loader

Globally enabled — Cloudflare rewrites <script> tags to type="text/rocketscript" and injects an async loader. Explicitly disabled on /admin/*.

ON

Any non-admin page (e.g. /)

In View Source (Ctrl+U), scripts become type="text/rocketscript". A rocket-loader.min.js is injected. In DevTools → Network, filter by rocket.

# Rocket Loader ON — look for "rocketscript" and the injected loader
curl -s https://<domain>/ | grep -iE "rocket|rocketscript"
OFF

Admin pages (/admin/)

Scripts appear exactly as the origin sent them — no rewriting, no injected loader. JavaScript executes synchronously.

# Rocket Loader OFF — scripts are unmodified, no "rocket" in output
curl -s https://<domain>/admin/ | grep -iE "rocket|rocketscript"

Compare side by side: open both pages and do View Source (Ctrl+U) to see the difference.

View / (Rocket Loader ON) → View /admin/ (Rocket Loader OFF) →