Blob Storage origin, locked down except via the CDN.
Read from the actual HTTP response just now — not hardcoded.
Each row is a real check run by your browser just now, against the acceptance criteria for this deployment.
The WAF check runs on demand rather than automatically, so a normal page load never sends attack-shaped traffic. Origin lockdown can't be verified honestly from browser JS — a cross-origin fetch to the storage endpoint gets blocked by CORS policy regardless of whether Azure's network firewall would allow or deny it, so "blocked" would show even when it shouldn't. That one's verified directly in the Azure Portal instead (see docs/screenshots/README.md step 8).