Pattern & Response Playground

Use this interactive playground to test RouteWarden's URL path normalization, built-in sensitive file blocking, allowlist bypasses, and custom regex rules. Simulate the live HTTP response returned by RouteWarden (including deceptive honeypots, gzip bombs, tarpits, and custom payloads) and export ready-to-use configurations for Caddy, NGINX (Lua / OpenResty), Traefik (YAML & TOML), Docker Compose, or Kubernetes.

Shareable Playground URLs: Click the Share button below the path bar to generate a direct link containing your current test path, HTTP method, client IP, custom rules, and response settings. Anyone opening the link will reproduce the exact simulation state.

GETPOSTPUTDELETEPATCHHEADOPTIONS

BLOCK

Try:

Anti-Evasion:/.env(Decoded 2 layer(s) percent-encoding, Canonicalized traversal (/../))

Block Patterns (blockPatterns)

Allow Patterns (allowPatterns)

Middleware Options

Built-in BlocklistBuilt-in AllowlistCheck QueryEnabledDebugSecurity Log (CrowdSec)

Check Headers:

Allowed IPs:

Trusted Proxies:

Inspect HTTP Verbs (methods):Non-selected verbs bypass inspection and forward directly to upstream backends

HTTP Response

Mode:jsonhtmltextxmlredirectproxy (honeypot)silentDrop (TCP RST)gzipBomb (zip bomb)tarpit (slow drip)rateLimitChallenge (429)infiniteStream (junk stream)fakeSuccess (HTTP 200)captcha (Turnstile/hCaptcha)Status:

Custom Body:

⚡ Verdict for Each HTTP Verb:Click any verb to inspect its live simulated response payload below

GET /.env403 Forbidden— Matches built-in pattern: (?i)(^|/)(\.env.*|.*\.(txt|log|bak|backup|sql|conf|config|ini|yaml|yml))$ on candidate path '/%252e%252e/.env'

Server:RouteWarden

X-RouteWarden-Blocked:true

X-Content-Type-Options:nosniff

Content-Type:application/json; charset=utf-8

{
  "error": "Forbidden",
  "status": 403,
  "message": "Access denied by RouteWarden security policy"
}

TraefikCaddyNGINXRouteWarden CLI

● routewarden.yml

http:
  middlewares:
    routewarden:
      plugin:
        routewarden:
          allowedIps:
            - "127.0.0.1"
            - "10.0.0.0/8"
          response:
            mode: json

---

How RouteWarden Evaluates Requests

The simulator follows the canonical evaluation sequence implemented identically across RouteWarden's Go core and OpenResty Lua modules:

TraefikCaddyNGINXRouteWarden CLI

---

Related Documentation

• RouteWarden CLI (rwarden): Command-line tool for offline path evasion testing, schema validation, and config generation.
• Custom Path Regex Guide: Syntax, cheat sheets, and production blueprints for popular frameworks.
• Anti-Evasion Engine: Technical breakdown of defeated evasion attacks.
• Response Modes Engine: All 13 response behaviors (JSON, Captcha, Gzip Bomb, Tarpit, etc.).
• Traefik Configuration, Caddyfile Reference & NGINX Configuration: Gateway-specific syntax.