{"id":7697,"date":"2026-04-15T09:49:48","date_gmt":"2026-04-15T07:49:48","guid":{"rendered":"https:\/\/mybox.com\/help\/?post_type=manual_kb&#038;p=7697"},"modified":"2026-04-15T09:49:50","modified_gmt":"2026-04-15T07:49:50","slug":"strategic-cloudflare-configuration-edge-caching-for-woocommerce","status":"publish","type":"manual_kb","link":"https:\/\/mybox.com\/help\/en\/knowledgebase\/strategic-cloudflare-configuration-edge-caching-for-woocommerce\/","title":{"rendered":"Strategic Cloudflare Configuration: Edge Caching for WooCommerce"},"content":{"rendered":"\n<div class=\"translation-block translation-block-merged\">\n<p class=\"wp-block-paragraph\">In <strong>2026<\/strong>, Cloudflare&#8217;s <strong>Cache Rules<\/strong> (the successor to Page Rules) have redefined how WooCommerce performance is handled. By utilizing &#8220;Edge-Cache&#8221; (also known as &#8220;Guest Caching&#8221; or APO), you can achieve <strong>TTFB (Time to First Byte) under 100ms<\/strong> globally.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\" id=\"p-rc_40565673e1330d08-239\">The core objective on <strong>mybox<\/strong> is to serve static HTML to guests while ensuring the cache is instantly bypassed the moment a user interacts with the cart, logs in, or personalizes their session.<sup><\/sup><\/p>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_86 ez-toc-wrap-left counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/strategic-cloudflare-configuration-edge-caching-for-woocommerce\/#1_Global_Cache_Rules_and_Header_Template\" >1. Global Cache Rules and Header Template<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/strategic-cloudflare-configuration-edge-caching-for-woocommerce\/#2_Hard_Bypasses_for_WooCommerce_Session_Integrity\" >2. Hard Bypasses for WooCommerce &amp; Session Integrity<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/strategic-cloudflare-configuration-edge-caching-for-woocommerce\/#3_Advanced_Performance_Early_Hints_103_Status\" >3. Advanced Performance: Early Hints &amp; 103 Status<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/strategic-cloudflare-configuration-edge-caching-for-woocommerce\/#4_Security_and_Origin_Protection\" >4. Security and Origin Protection<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/strategic-cloudflare-configuration-edge-caching-for-woocommerce\/#5_Troubleshooting_and_Cache_Validation\" >5. Troubleshooting and Cache Validation<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/mybox.com\/help\/en\/knowledgebase\/strategic-cloudflare-configuration-edge-caching-for-woocommerce\/#Summary\" >Summary<\/a><\/li><\/ul><\/nav><\/div>\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"1_Global_Cache_Rules_and_Header_Template\"><\/span><strong>1. Global Cache Rules and Header Template<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<\/div>\n\n<div id=\"mybox-2122484743\" class=\"mybox-content mybox-entity-placement\"><div class=\"early-access-banner-inpost\">\r\n  <div class=\"banner-left-inpost\">\r\n    <div class=\"icon-box-inpost\">\r\n      <img decoding=\"async\" src=\"https:\/\/mybox.com\/help\/wp-content\/uploads\/2026\/02\/square-info-icon.svg\" alt=\"Info\">\r\n    <\/div>\r\n    <div class=\"text-box-inpost\">\r\n      <span class=\"label-inpost\"><span class=\"translation-block translation-block-banner-text\">Early access<\/span><\/span>\r\n      <h4><span class=\"translation-block translation-block-banner-text\">Still need help?<\/span><\/h4>\r\n      <p><span class=\"translation-block translation-block-banner-text\">Contact our customer service team.<\/span><\/p>\r\n    <\/div>\r\n  <\/div>\r\n\r\n  <div class=\"banner-right-inpost\">\r\n    <a href=\"https:\/\/panel.mybox.com\/helpdesk2\/v\/list\/\" class=\"banner-button-inpost\"><span class=\"translation-block translation-block-banner-text\">Message us<\/span><\/a>\r\n  <\/div>\r\n<\/div><\/div>\n\n<div class=\"translation-block translation-block-merged\"><p class=\"wp-block-paragraph\">On <strong>mybox<\/strong>, you should move away from the &#8220;standard&#8221; caching level to a more aggressive <strong>Cache Everything<\/strong> strategy, but only for specific traffic.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Rule 1: Aggressive Guest Caching<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Field:<\/strong> <code>Cookie<\/code> (does not contain <code>wordpress_logged_in<\/code>) <strong>AND<\/strong> <code>URI Path<\/code> (does not contain <code>\/wp-admin<\/code>) <strong>AND<\/strong> <code>Cookie<\/code> (does not contain <code>wp_woocommerce_session<\/code>).<\/li>\n\n\n\n<li><strong>Setting:<\/strong> Eligible for Cache + <strong>Edge Cache TTL<\/strong> (e.g., 2 hours).<\/li>\n\n\n\n<li><strong>Normalization:<\/strong> Use <strong>Cache Key<\/strong> settings to &#8220;Ignore Query Strings&#8221; like <code>utm_source<\/code>, <code>gclid<\/code>, and <code>fbclid<\/code> to avoid cache fragmentation.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Rule 2: Browser TTL and Stale-While-Revalidate<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Configure <strong>Browser Cache TTL<\/strong> to be shorter than Edge TTL (e.g., 30 minutes).<\/li>\n\n\n\n<li>Enable <strong>Stale-While-Revalidate<\/strong> in Cloudflare Speed settings. This allows the edge to serve a &#8220;stale&#8221; version of your <strong>mybox<\/strong> site instantly while fetching a fresh copy in the background.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"2_Hard_Bypasses_for_WooCommerce_Session_Integrity\"><\/span><strong>2. Hard Bypasses for WooCommerce &amp; Session Integrity<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">WooCommerce requires &#8220;Stateful&#8221; integrity. If a user sees another person&#8217;s cart, it is a critical security failure.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Paths to Bypass (Hard Rules):<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You must set a <strong>Bypass Cache<\/strong> rule for the following URI paths:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>\/cart\/*<\/code><\/li>\n\n\n\n<li><code>\/checkout\/*<\/code><\/li>\n\n\n\n<li><code>\/my-account\/*<\/code><\/li>\n\n\n\n<li><code>\/wp-admin\/*<\/code><\/li>\n\n\n\n<li><code>\/wc-ajax\/*<\/code> (Critical for dynamic price updates and fragments).<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Cookie-Based Bypasses:<\/strong><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Configure Cloudflare to bypass the cache if any of these cookies are present:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><code>wp_woocommerce_session_*<\/code><\/li>\n\n\n\n<li><code>woocommerce_items_in_cart<\/code><\/li>\n\n\n\n<li><code>woocommerce_cart_hash<\/code><\/li>\n\n\n\n<li><code>wordpress_logged_in_*<\/code><\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"3_Advanced_Performance_Early_Hints_103_Status\"><\/span><strong>3. Advanced Performance: Early Hints &amp; 103 Status<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\" id=\"p-rc_40565673e1330d08-240\"><strong>Early Hints (103)<\/strong> is a breakthrough for 2026. It allows Cloudflare to send &#8220;hints&#8221; to the browser about critical assets (fonts, hero images, main CSS) <em>before<\/em> the server has finished generating the HTML.<sup><\/sup><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Implementation on mybox:<\/strong> Enable &#8220;Early Hints&#8221; in the Cloudflare Speed dashboard.<\/li>\n\n\n\n<li><strong>Link Headers:<\/strong> Use a plugin or a <strong>WPCode<\/strong> snippet to add <code>Link<\/code> headers to your initial response:<code>Link: &lt;\/wp-content\/themes\/my-theme\/style.css>; rel=preload; as=style<\/code><\/li>\n\n\n\n<li><strong>Result:<\/strong> This can reduce <strong>LCP (Largest Contentful Paint)<\/strong> by up to 200\u2013400ms.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"4_Security_and_Origin_Protection\"><\/span><strong>4. Security and Origin Protection<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Cashing is useless if your origin server is overwhelmed by bots.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Turnstile (CAPTCHA replacement):<\/strong> Use Cloudflare Turnstile on your login and registration pages. It provides zero-friction protection against brute-force attacks on your <strong>mybox<\/strong> admin.<\/li>\n\n\n\n<li><strong>WAF (Web Application Firewall):<\/strong> Enable the &#8220;WordPress&#8221; managed rule set. This automatically blocks known vulnerabilities in popular plugins like Elementor, Contact Form 7, and WooCommerce.<\/li>\n\n\n\n<li><strong>Authenticated Origin Pulls:<\/strong> Ensure that your <strong>mybox<\/strong> server <em>only<\/em> accepts traffic from Cloudflare\u2019s IP ranges. This prevents attackers from bypassing Cloudflare to attack your IP directly.<\/li>\n<\/ul>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"5_Troubleshooting_and_Cache_Validation\"><\/span><strong>5. Troubleshooting and Cache Validation<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">To verify your setup is working on <strong>mybox<\/strong>, open the browser console (<code>F12<\/code>) -&gt; Network Tab and check the <strong><code>cf-cache-status<\/code><\/strong> header:<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><thead><tr><td><strong>Header Value<\/strong><\/td><td><strong>Meaning<\/strong><\/td><td><strong>Action for mybox<\/strong><\/td><\/tr><\/thead><tbody><tr><td><strong>HIT<\/strong><\/td><td>Served from Cloudflare Edge.<\/td><td>Correct for Guest Home\/Product pages.<\/td><\/tr><tr><td><strong>BYPASS<\/strong><\/td><td>Ignored due to a Rule\/Cookie.<\/td><td>Correct for Cart, Checkout, and Admin.<\/td><\/tr><tr><td><strong>DYNAMIC<\/strong><\/td><td>Passed to origin (uncacheable).<\/td><td>Correct for Search or private dynamic data.<\/td><\/tr><tr><td><strong>STALE<\/strong><\/td><td>Serving old data while refreshing.<\/td><td>Normal if &#8220;Stale-While-Revalidate&#8221; is on.<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h3 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Summary\"><\/span><strong>Summary<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The ultimate <strong>mybox + Cloudflare<\/strong> setup uses <strong>Cache Rules<\/strong> to turn your dynamic WordPress site into a static-speed powerhouse for guests, while using <strong>Cookie Bypasses<\/strong> to maintain a perfect shopping experience for customers. By enabling <strong>Early Hints<\/strong> and <strong>Brotli compression<\/strong>, you ensure your store is among the fastest 1% on the web in 2026.<\/p>\n<\/div>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"template":"","format":"standard","manualknowledgebasecat":[58,60],"manual_kb_tag":[9494,9505,9506,9507,9508,936,2239,6195,6285,9492],"class_list":["post-7697","manual_kb","type-manual_kb","status-publish","format-standard","hentry","manualknowledgebasecat-web-applications-cms","manualknowledgebasecat-wordpress-plugins","manual_kb_tag-guest-caching","manual_kb_tag-cache-rules","manual_kb_tag-cache-key","manual_kb_tag-ignore-query-strings","manual_kb_tag-stale-while-revalidate","manual_kb_tag-cloudflare","manual_kb_tag-browser-cache","manual_kb_tag-edge-caching","manual_kb_tag-edge-cache","manual_kb_tag-cache-everything"],"_links":{"self":[{"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manual_kb\/7697","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manual_kb"}],"about":[{"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/types\/manual_kb"}],"author":[{"embeddable":true,"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/users\/1"}],"version-history":[{"count":1,"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manual_kb\/7697\/revisions"}],"predecessor-version":[{"id":7698,"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manual_kb\/7697\/revisions\/7698"}],"wp:attachment":[{"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/media?parent=7697"}],"wp:term":[{"taxonomy":"manualknowledgebasecat","embeddable":true,"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manualknowledgebasecat?post=7697"},{"taxonomy":"manual_kb_tag","embeddable":true,"href":"https:\/\/mybox.com\/help\/en\/wp-json\/wp\/v2\/manual_kb_tag?post=7697"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}