WooCommerce on CDN – what to cache and what not to cache

Strategically managing your WooCommerce store on a CDN is about mastering the balance between speed and session integrity. In 2026, the goal is to serve static-grade performance for guests while ensuring zero-latency, private interactions for shoppers.

On your mybox server, an incorrect CDN configuration is the #1 cause of “leaked carts” (where one user sees another’s items) or checkout failures.

The “Golden Rule” of WooCommerce Caching

Cache HTML only for guests. Never cache a page that contains a unique user session ID or a Set-Cookie header for a private session.

1. The “What” to Cache (The Guest Experience)

For users who are not logged in and have an empty cart, you should aggressively cache these elements at the CDN edge:

• Product & Category Pages: These are your heaviest pages. Caching them at the edge can drop your TTFB from 800ms to 50ms.
• The Homepage & Blog: High-traffic landing pages should always be cached.
• Static Assets (Images, CSS, JS): Use a long TTL (e.g., 30 days) with Brotli compression enabled.
• WebP/AVIF Variants: Ensure your CDN supports varying content based on the Accept header so modern browsers get the fastest formats.

2. The “What NOT” to Cache (The Private Experience)

To avoid session leaks on mybox, you must create explicit Bypass Rules for:

• Dynamic Paths: /cart/*, /checkout/*, /my-account/*, /wp-admin/*.
• AJAX Endpoints: /wc-ajax=* and ?wc-ajax=get_refreshed_fragments. These update the mini-cart and must always be live.
• Sensitive Parameters: Any URL containing ?add-to-cart=, ?logout=, or ?password-reset=.

3. Professional Cloudflare Configuration for 2026

If you are using Cloudflare for your mybox store, follow this priority-ordered setup in Cache Rules:

Rule A: Hard Bypass (Priority 1)

• Criteria: If URI Path contains /cart/ OR /checkout/ OR /my-account/.
• Action: Bypass Cache.

Rule B: Cookie-Based Bypass (Priority 2)

• Criteria: If Cookie contains wordpress_logged_in OR wp_woocommerce_session OR woocommerce_items_in_cart.
• Action: Bypass Cache. This ensures that the moment a guest adds an item to their cart, they leave the “static” edge and start getting live data from your mybox server.

Rule C: Cache Everything (Priority 3)

• Criteria: (Default/Rest of site).
• Action: Eligible for Cache. Set Edge Cache TTL to 2 hours and Browser Cache TTL to 30 minutes.

4. Advanced 2026 Performance: Early Hints & APO

• Early Hints (103): Enable this in Cloudflare Speed settings. It sends Link headers for your main CSS and fonts before the server finishes the HTML, cutting LCP by up to 30%.
• Automatic Platform Optimization (APO): For $5/mo, Cloudflare’s official plugin handles all the complex bypass logic automatically. It is the safest “set and forget” way to speed up WooCommerce on mybox.

5. Safety and Reliability Checklist

• Vary Header: Ensure your server sends Vary: Cookie. This tells the CDN that the version of the page depends on the user’s cookies.
• Cache-Control: no-store: On your cart and checkout pages, your mybox server must send Cache-Control: no-store, no-cache, must-revalidate. This is your ultimate fail-safe.
• Test with Two Browsers: Add an item to the cart in Chrome, then check the same page in Firefox Incognito. If you see the item in Firefox, your cache rules are failing.

Summary

The perfect WooCommerce CDN setup is a “guest-first” strategy. By aggressively caching product pages for visitors and using Cookie-based bypasses for shoppers, you provide a lightning-fast experience without ever risking a session leak.