Low-latency reads with eventual consistency. Good for flags, preferences, and cached responses—not transactional balances.
OPTIMIZE FOR READS01 / THE EDGE
EVERY REQUEST · BEFORE ORIGIN
Security
becomes
the edge.
Global application security, active by default.
Live evidence is ready to inspect
Not yet run
01 Front door04 WAF05 Live block06 Evidence08 Human09 APIs
01 / DEPLOY AN APPLICATION
Security ships
with the application.
This deck runs as a versioned Worker: globally deployed request logic without a separate server fleet for the edge layer.
V8 isolatestateless requestedge executionWeb APIs
terminal
$ pnpm test
$ pnpm build
$ pnpm deploy
Uploaded innovative-future-solutions-security-demo
Deployed globally02 / CONFIGURE A CUSTOM DOMAIN
One front door.
Fewer policy gaps.
The application hostname enters Cloudflare once; DNS, TLS, security policy, and Worker execution share the same controlled path.
◆ innovativefuturesolutions.com
Custom Domains make the Worker the origin—no separate web server is required.
PUBLIC DNS
innovativefuturesolutions.com
proxied
NEAREST CLOUDFLARE LOCATION
Security + Worker execution
invokes
APPLICATION
Deck + API endpoints
03 / ENABLE HTTPS
✓
Every request starts
inside the boundary.
Managed TLS establishes the edge session before security policy evaluates traffic and application code runs.
SCHEMEHTTPSforced at edge
TRANSPORTTLSlive negotiation
POLICYHSTSpreload eligible
04 / ADD A WAF RULE
Block known abuse
before code runs.
A scoped custom rule matches the agreed XSS demo signal and stops it at the edge—before Worker execution.
IF
path == "/attack-lab"
AND
query contains "attack=xss"
BLOCK
05 / SHOW THE REQUEST BEING BLOCKED
Prove the control.
Protect the journey.
01 Baseline
02 Attack
03 Evidence
The probe is intentionally non-executing; it exists only in the URL and matches the WAF demo rule.
LIVE RESPONSEREADY
Choose a request to send through Cloudflare.
06 / SHOW THE SECURITY EVENT
Evidence replaces
security guesswork.
Action, rule, path, timestamp, and Ray ID create the chain of evidence needed to investigate and tune policy.
Open Cloudflare Security Events ↗07 / ADD BOT MANAGEMENT
Treat automation
by risk.
Bot Fight Mode challenges detected malicious automation across this Free-plan zone without requiring application changes.
Plan-aware demo
Enterprise Bot Management score rules are not available on this zone, so the deck names the actual control in use.
verified botautomationbrowser
CONTROLChecking…
08 / ADD TURNSTILE TO LOGIN
Add friction only
when risk earns it.
Turnstile places an application-controlled checkpoint on a sensitive action; the Worker accepts only a server-verified token.
- Browser receives token
- Worker calls Siteverify
- Only verified request succeeds
09 / MAKE THE API SURFACE EXPLICIT
Unknown APIs cannot
stay invisible.
A declared OpenAPI contract plus edge endpoint inventory turns the actual surface into something teams can review, protect, and govern.
Checking endpoint management…
Open the machine-readable schema →
GUIDED CLOUDFLARE CANARYOpen the highlighted control graph ↗
WAFBOTSAPIsRATE
LIVE ABUSE CONTROL5 requests / 10 seconds
METHODENDPOINTTRY
POST
/api/demo/loginTurnstileGET
/api/docscataloguedLIVE EDGE RESPONSEREADY
Select a GET operation to inspect its public-safe response.Open full response in PlatPhorm JSON ↗
10 / HOW CLOUDFLARE PROTECTS THE APPLICATION
Security decisions happen before origin.
01Visitorbrowser · bot · API client
02Cloudflare Edge
- TLS + DDoS
- WAF rules
- Bot signals
- Turnstile
- API inventory
allowed only
03Workerdeck · API · validation
Blocked traffic never reaches application code. Allowed requests carry security context and evidence forward while application teams keep ownership of authorization and business logic.
See the adoption plan →ARCHITECTURE NOTE 01 / CHOOSE STATE BY CONSISTENCY
State is a
design choice.
Start with the invariant: global read speed, relational queries, strong coordination, object durability, or an existing regional database.
INTERACTIVE SCENARIO
Strongly consistent coordination for chat rooms, locks, rate limits, multiplayer state, and collaborative sessions.
OPTIMIZE FOR COORDINATIONManaged serverless SQL with SQLite semantics for structured metadata, accounts, and lightweight full-stack applications.
OPTIMIZE FOR SQLS3-compatible, strongly consistent object storage with no egress fees for assets, uploads, backups, and datasets.
OPTIMIZE FOR BYTESPool connections and accelerate PostgreSQL or MySQL. Disable query caching where read-after-write consistency is required.
OPTIMIZE THE MIGRATIONARCHITECTURE NOTE 02 / MOVE SPECIALIZED WORK OFF THE REQUEST PATH
The edge is a platform.
Not just a proxy.
Keep the request path short, then bind purpose-built services for background work, inference, retrieval, and browser automation.
ARCHITECTURE SIMULATION · NOT PROVISIONED BY THIS DEMO
Authenticate, route, validate, transform, and return the latency-sensitive result.
Decouple expensive work with at-least-once delivery; consumers must be idempotent.
Invoke open-source models on serverless GPUs without provisioning inference infrastructure.
Store and query embeddings for semantic search, recommendations, and RAG.
Control headless browsers for screenshots, PDFs, scraping, testing, and agent tasks.
Bindings are the connective tissue: the Worker receives platform capabilities through its environment instead of exposing service credentials to browser code.
THE DECISION / START WITH ONE APPLICATION
A SAFE PATH TO STANDARDIZATION
Prove the controls.
Scale the operating model.
Approve a 30-day, production-like AppSec pilot with one hostname, one agreed attack path, one login journey, and one critical API.
THE ASK
One application · named owners · measurable exit criteria
- 01Baseline
Inventory hostnames, critical journeys, APIs, and origin exposure.
- 02Observe
Proxy traffic, preserve correlation, and establish false-positive baselines.
- 03Enforce
Stage WAF, bot, Turnstile, and API controls with explicit rollback.
- 04Scale
Template policy, connect evidence, and assign ongoing control ownership.
EXIT CRITERIA
- Critical journeys stay green
- Agreed attack is blocked and correlated
- False positives remain within threshold
- Rollback is tested and owned
Download the AppSec runbook ↓
Replay the live proof ↺
Cloudflare official guidance supports layered WAF, bot, and Turnstile controls; the pilot determines fit, policy, ownership, and measurable value for this environment.