Pattern & Response Playground

Use this interactive playground to test RouteWarden's URL path normalization, built-in sensitive file blocking, allowlist bypasses, and custom regex rules. Simulate the live HTTP response returned by RouteWarden (including deceptive honeypots, gzip bombs, tarpits, and custom payloads) and export ready-to-use configurations for Caddy, NGINX (Lua / OpenResty), Traefik (YAML & TOML), Docker Compose, or Kubernetes.

Shareable Playground URLs: Click the Share button below the path bar to generate a direct link containing your current test path, HTTP method, client IP, custom rules, and response settings. Anyone opening the link will reproduce the exact simulation state.

GETPOSTPUTDELETEPATCHHEADOPTIONS

BLOCK

Try:

Anti-Evasion:/.env(Decoded 2 layer(s) percent-encoding, Canonicalized traversal (/../))

Block Patterns (pathPatterns)

Allow Patterns (allowPatterns)

Middleware Options

Built-in BlocklistBuilt-in AllowlistCheck QueryEnabledDebugSecurity Log (CrowdSec)

Check Headers:

Allowed IPs:

Inspect HTTP Verbs (methods):Non-selected verbs bypass inspection and forward directly to upstream backends

HTTP Response

Mode:jsonhtmltextxmlredirectproxy (honeypot)silentDrop (TCP RST)gzipBomb (zip bomb)tarpit (slow drip)rateLimitChallenge (429)infiniteStream (junk stream)fakeSuccess (HTTP 200)captcha (Turnstile/hCaptcha)Status:

Custom Body:

⚡ Verdict for Each HTTP Verb:Click any verb to inspect its live simulated response payload below

GET /.env403 Forbidden— Matches built-in pattern: (?i)(^|/)(\.env.*|.*\.(txt|log|bak|backup|sql|conf|config|ini|yaml|yml))$ on candidate path '/%252e%252e/.env'

Server:RouteWarden

X-RouteWarden-Blocked:true

X-Content-Type-Options:nosniff

Content-Type:application/json; charset=utf-8

{
  "error": "Forbidden",
  "status": 403,
  "message": "Access denied by RouteWarden security policy"
}

TraefikCaddyNGINXRouteWarden CLI

● routewarden.yml

http:
  middlewares:
    routewarden:
      plugin:
        routewarden:
          allowedIps:
            - "127.0.0.1"
            - "10.0.0.0/8"
          response:
            mode: json

---

How RouteWarden Evaluates Requests

The simulator follows the canonical evaluation sequence implemented identically across RouteWarden's Go core and OpenResty Lua modules:

Incoming Request
       │
       ▼
┌─────────────────────────┐
│ 1. IP Whitelist Match?  │ ─── (Matches allowedIps / CIDRs) ───► Bypassed & Forwarded
└─────────────────────────┘
       │ No
       ▼
┌─────────────────────────┐
│ 2. Anti-Evasion Engine  │
│ - Multi-layer Unescape  │ ─── (%252e ➔ .)
│ - Semicolon Stripping   │ ─── (/path;param/.. ➔ /path/..)
│ - Backslash Convert     │ ─── (\ ➔ /)
│ - Traversal Canonical   │ ─── (/static/../.env ➔ /.env)
└─────────────────────────┘
       │ Normalized Candidate Path
       ▼
┌─────────────────────────┐
│ 3. Allowlist Check      │
│ - Built-in Safe Rules   │ ─── (/robots.txt, /.well-known/*, etc.) ──► Allowed & Forwarded
│ - Custom allowPatterns  │
└─────────────────────────┘
       │ No
       ▼
┌─────────────────────────┐
│ 4. Blocklist Check      │
│ - Built-in Dictionaries │ ─── (Matches .env, .git, dumps, etc.) ──► Intercepted & Challenged
│ - Custom pathPatterns   │
└─────────────────────────┘
       │ No
       ▼
┌─────────────────────────┐
│ 5. Clean Request        │ ─── Forwarded to Upstream Backends
└─────────────────────────┘

---

Related Documentation

• RouteWarden CLI (rwarden): Command-line tool for offline path evasion testing, schema validation, and config generation.
• Custom Path Regex Guide: Syntax, cheat sheets, and production blueprints for popular frameworks.
• Anti-Evasion Engine: Technical breakdown of defeated evasion attacks.
• Response Modes Engine: All 13 response behaviors (JSON, Captcha, Gzip Bomb, Tarpit, etc.).
• Traefik Configuration, Caddyfile Reference & NGINX Configuration: Gateway-specific syntax.