Stop Cloudflare From Caching Dynamic WordPress Pages

To stop Cloudflare from caching dynamic WordPress pages, you need to configure Cloudflare’s caching rules to bypass or bypass-and-set-cache for URLs that should always be fresh, and ensure your WordPress site sends the right cache-control headers. This article explains the exact settings, the common pitfalls, and how to verify your changes actually work.

Why Cloudflare Caches Dynamic Pages

Cloudflare is a content delivery network (CDN) and reverse proxy that sits between your visitors and your WordPress server. By default, Cloudflare caches static assets like images, CSS, and JavaScript, but it does not cache HTML pages unless you explicitly enable a caching rule for them. However, many WordPress sites use plugins or custom code that send Cache-Control: public headers, or they have a Cloudflare setting like “Cache Everything” turned on, which causes dynamic pages (shopping carts, user dashboards, comment forms) to be cached. When that happens, visitors see stale content, and logged-in users might see someone else’s data.

How Cloudflare Decides What to Cache

Cloudflare’s caching decision is based on three factors: the cache level (standard vs. everything), the presence of a Cache-Control header from your origin server, and any explicit Cache Rules or Page Rules you’ve created. The default cache level is “Standard,” which caches static files only. If you set it to “Cache Everything,” Cloudflare caches all responses that don’t have a Cache-Control: no-store or no-cache header. Even with standard caching, a WordPress plugin that adds Cache-Control: public, max-age=3600 to a dynamic page will make Cloudflare cache it.

Step-by-Step: Stop Caching Dynamic Pages

1. Log in to your Cloudflare dashboard and select your domain.
2. Go to Caching > Configuration. Under Caching Level, ensure it’s set to Standard (not “Cache Everything”).
3. Go to Caching > Cache Rules (or Page Rules if you’re on a free plan, though Cache Rules are now available to all).
4. Create a new rule. For the URL pattern, use a wildcard that matches your dynamic pages. For example, if your cart is at /cart/, use example.com/cart/*. If you want to exclude all WordPress admin and login pages, use example.com/wp-admin/* and example.com/wp-login.php.
5. Set the action to Bypass cache (or Bypass and set cache level: Bypass). This tells Cloudflare to never store a copy of these responses.
6. Save the rule. Then test by visiting the page as a logged-out user and checking the response headers (see below).

How to Verify the Cache is Actually Bypassed

After creating the rule, you need to confirm that Cloudflare is not serving a cached copy. Open your browser’s developer tools (F12) and go to the Network tab. Reload the dynamic page and click on the document request. Look at the Response Headers. If the page is being served from Cloudflare’s cache, you’ll see CF-Cache-Status: HIT. If it’s bypassed, you’ll see CF-Cache-Status: BYPASS or DYNAMIC. Also check for Cache-Control: no-store or no-cache in the response. If you see HIT, your rule isn’t matching—double-check the URL pattern and ensure the rule is enabled.

Common Mistakes and Misconceptions

• Using “Cache Everything” for the whole site: This is the most common cause. Only use it for static pages like landing pages or marketing pages, and always combine it with a Cache Rule to exclude dynamic sections.
• Forgetting logged-in users: Cloudflare does not automatically know if a user is logged in. If you use a caching plugin that serves cached pages to everyone, logged-in users might see cached content. Always set the Cache Rule to bypass for URLs that contain wp-admin, wp-login.php, and any page that shows personalized data.
• Relying on the “Development Mode” toggle: Development Mode disables caching for 3 hours, but it’s not a permanent solution. It’s useful for testing, but you need a proper rule.
• Not purging the cache after changing rules: Even if you create a bypass rule, Cloudflare may still serve a previously cached copy. Go to Caching > Configuration and click Purge Everything after making changes.

Alternative: Use a WordPress Caching Plugin with Cloudflare

Many WordPress sites use a caching plugin like WP Rocket, W3 Total Cache, or LiteSpeed Cache. These plugins can send the correct Cache-Control headers and even integrate with Cloudflare’s API to purge the CDN cache when you update a post. If you use one, make sure the plugin’s “Cache Dynamic Pages” option is disabled, and configure the plugin to exclude cart, checkout, and my-account pages. The plugin will then send Cache-Control: no-store for those pages, and Cloudflare will respect that header (as long as you haven’t set a Cache Rule that overrides it).

What About the WordPress Admin and AJAX?

WordPress admin pages (/wp-admin/) and AJAX endpoints (/wp-admin/admin-ajax.php) should never be cached. Create a Cache Rule for example.com/wp-admin/* and example.com/wp-login.php with the action Bypass cache. Also, if you use a plugin like WooCommerce, add rules for /cart/, /checkout/, /my-account/, and any page that uses session cookies. You can also set a rule to bypass any URL that contains a query string (e.g., ?add-to-cart=123) because those are often dynamic.

Frequently Asked Questions

Why is my WordPress page still showing cached content after I set a bypass rule?

First, check that the rule’s URL pattern matches exactly. Cloudflare uses wildcards, so example.com/cart/* will match /cart/ and /cart/anything, but not /cart without a trailing slash. Also, ensure the rule is enabled and that you’ve purged the cache after saving it. Finally, check the response headers—if you see CF-Cache-Status: HIT, the rule isn’t applied.

Does Cloudflare cache WordPress pages by default?

No. With the default settings, Cloudflare only caches static files (images, CSS, JS). HTML pages are not cached unless you set a Cache Rule to “Cache Everything” or your origin server sends a Cache-Control: public header for them. Many WordPress plugins inadvertently do this, so it’s important to check your headers.

What is the difference between “Bypass cache” and “Bypass and set cache level”?

In Cache Rules, “Bypass cache” tells Cloudflare to not store the response at all. “Bypass and set cache level” is a legacy option that also sets the cache level to “Bypass” but is functionally the same. Use either one—just make sure the action is set to bypass, not to “Cache Everything.”

Will bypassing cache slow down my site?

Yes, for those specific pages, because every request goes to your origin server. But dynamic pages (cart, checkout, user account) already require server-side processing, so the impact is minimal. You can still use Cloudflare’s other performance features like Argo Smart Routing and Railgun (if available) to speed up the connection.

Can I use Page Rules instead of Cache Rules?

Yes, Page Rules are the older feature and still work. However, Cloudflare is encouraging users to migrate to Cache Rules because they offer more granular control and are available on all plans. If you use Page Rules, set the “Cache Level” to “Bypass” for the dynamic URLs. Note that Page Rules have a limit of 3 on the free plan, while Cache Rules have a higher limit.

Should I disable Cloudflare’s caching entirely for my WordPress site?

Not necessarily. Caching static assets is beneficial and doesn’t affect dynamic content. The key is to be selective: cache static files and static HTML pages (like your homepage if it doesn’t change often), but bypass pages that are unique per user. This gives you the best performance without breaking functionality.

Related

• North Korean APT Expands Attack Repertoire: TA444 Changes
• WoW Fist Weapons: Where to Learn as Alliance
• Per-Call Worker Cost in Synchronous Services