Heimwall Playground

A live origin server that mirrors what the Heimwall edge sees and lets you exercise cache, headers, rate-limit and challenge behaviour.

Request — URL rule set

MethodGET
Schemehttps
Hostdemotest.netinternet.org
URLhttps://demotest.netinternet.org/
URI/
URI Path/
Query
HTTP (edge→origin)HTTP/1.1
HTTP (client→edge)
TLS
RemoteAddr159.253.42.2:45058

This is not a defined route. The playground never returns 404 — every URL renders this inspector so you can test any URI / URL / URI Path against your Heimwall rules.

Edge view — what Heimwall sees

These headers are injected by the Heimwall node before the request reaches this origin. Use them to build geo/IP rules and to confirm the real client.

Client IP216.73.216.228
CountryUS
ASN16509
H-Ray
Edge
True-Client-Ip216.73.216.228
True-Client-Port46643
True-Client-CountryUS
True-Client-Asn16509
X-Real-Ip216.73.216.228
X-Forwarded-For216.73.216.228
X-Forwarded-Hostdemotest.netinternet.org
X-Forwarded-Port46643
X-Forwarded-Protohttps
X-Forwarded-Schemehttps
Forwardedfor=216.73.216.228;proto=https;host=demotest.netinternet.org

Query parameters

No query parameters.

Cookies

No cookies on this request.

Request headers

Accept*/*
Accept-Encodinggzip, br, zstd, deflate
Forwardedfor=216.73.216.228;proto=https;host=demotest.netinternet.org
True-Client-Asn16509
True-Client-CountryUS
True-Client-Ip216.73.216.228
True-Client-Ja3771,4866-4865-4867-49196-49195-52393-49200-49199-52392-255,51-10-13-43-23-11-16-45-5-0-35,29-23-24,0
True-Client-Ja3-Hash575d91eb9c53a18dd488c3f08fc6922d
True-Client-Ja4t13d1011h2_61a7ad8aa9b6_3fcd1a44f3e3
True-Client-Port46643
User-AgentMozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +claudebot@anthropic.com)
X-Forwarded-For216.73.216.228
X-Forwarded-Hostdemotest.netinternet.org
X-Forwarded-Port46643
X-Forwarded-Protohttps
X-Forwarded-Schemehttps
X-Real-Ip216.73.216.228

Response headers (set by this origin)

X-Playground-Instanceplayground-local
X-Playground-RegionLOCAL
X-Playground-Version5476c87

Forms & challenge tests

Submit these forms through Heimwall: even if a JS or Captcha challenge appears, the full response is delivered and echoed below once you pass it.

Tip: trigger a challenge in Heimwall for this path, then submit — the playground still returns the complete response.

Text form (POST)

Plain fields, application/x-www-form-urlencoded.

File upload (multipart)

One or more files; size, type and SHA-256 are echoed back.

Feature demos

Each endpoint exercises one Heimwall feature. Hit them through the edge and watch the response headers.

🧪 Feature lab Watch Heimwall edge transforms live: auto-minify, image optimization, cache and HTTP protocol. Open the lab → 🪝 Webhooks Receive Heimwall rule / challenge / IP-ban webhooks and inspect them live.

Cache

Cache-friendly headers vs no-store — watch HIT / MISS at the edge.

/cache/cacheable /cache/dynamic /cache/no-store

Headers & compression

Emit custom response headers and a compressible body.

/headers/set /compress

Rate-limit & WAF

Flood the rate-limiter (429) and reflect WAF payloads at the edge.

/ratelimit/burst /waf/echo

Maintenance & origin status

Take this origin down so Heimwall health checks fail it over, then auto-recover.

Disables the whole instance until the window ends.

/status/:code/delay/:ms

REST · /api/echo · /api/whoami · /version · /healthz