How to Configure Cloudflare Page Rules & Cache Everything for WordPress

Why Default Cloudflare Does Not Cache WordPress HTML

Cloudflare’s standard caching configuration only caches assets matching specific static file extensions (.jpg, .css, .js, .webp). Because WordPress generates dynamic HTML pages via PHP and MySQL, Cloudflare forwards every page request to your origin web server.

Enabling Cache Everything turns Cloudflare into a global edge page cache, allowing your website to handle tens of thousands of concurrent visitors on a free shared hosting account without crashing.

Step 1: Creating the WP-Admin Cache Bypass Rule (Priority 1)

Never cache administrative interfaces or preview links. In Cloudflare dashboard, navigate to Rules > Page Rules (or Caching > Cache Rules) and create your first rule:

URL Pattern: *yourdomain.com/wp-admin*
Settings:
  - Cache Level: Bypass
  - Security Level: High

Step 2: Creating the Preview and Login Bypass Rule (Priority 2)

URL Pattern: *yourdomain.com/*preview=true*
Settings:
  - Cache Level: Bypass

Step 3: Creating the Global Cache Everything Rule (Priority 3)

Create the primary edge caching rule covering all public content:

URL Pattern: *yourdomain.com/*
Settings:
  - Cache Level: Cache Everything
  - Edge Cache TTL: 7 days
  - Browser Cache TTL: 4 hours

Bypassing Cache for Logged-In Users via Super Page Cache Plugin

To ensure logged-in users and WooCommerce shoppers see personalized cart contents without paying for Cloudflare Enterprise, install the free Super Page Cache for Cloudflare plugin by Optimole. This plugin hooks into WordPress authentication cookies and injects Cache-Control: no-cache headers whenever a user logs in or adds an item to cart.

Advanced Cloudflare Edge Caching: Tuning Cache Keys and Headers

To maximize your cache hit ratio without serving stale content to active eCommerce shoppers, configure custom Cache Keys under Caching > Cache Rules:

Expression: (http.request.uri.path matches "^/shop/" or http.request.uri.path matches "^/product/")
Action: Cache Everything
Edge TTL: 1 Month
Respect Origin Cache-Control Headers: Yes

Handling WordPress Nonces and Dynamic AJAX Fragments

WordPress CSRF security nonces expire every 12 to 24 hours. If full HTML pages are cached at the edge for 7 days, visitors submitting comments or contact forms will receive “Nonce verification failed” errors. To solve this, configure contact form plugins (like WPForms or Fluent Forms) to fetch fresh nonces dynamically via asynchronous AJAX requests (/wp-admin/admin-ajax.php).

Verifying Edge Cache Hits with CF-Cache-Status Headers

Inspect incoming HTTP response headers in Chrome DevTools to verify caching behavior:

• cf-cache-status: HIT: The HTML was served directly from Cloudflare Anycast memory (Sub-30ms response).
• cf-cache-status: MISS: The page was fetched from your origin server and cached for future visitors.
• cf-cache-status: BYPASS: The request matched an admin or checkout bypass rule and was delivered dynamically.

Edge Side Includes (ESI) and Dynamic Micro-Caching on Cloudflare

For complex WooCommerce stores with active customer accounts, standard page caching can inadvertently cache logged-in customer names or shopping cart totals. Combining Cloudflare Cache Rules with Edge Side Includes (ESI) allows you to cache 98% of the static HTML markup at the edge while streaming dynamic shopping cart fragments asynchronously via JavaScript Fetch API.

Benchmarking Edge Cache Everything vs Origin TTFB

Frequently Asked Questions

Automating Cache Purges on Custom Post Types and Taxonomy Archives

When publishing articles in custom post types or updating product categories, standard caching plugins may only purge the single post URL. In your Cloudflare Cache Rules, configure automated purge tags (Cache-Tag headers) to ensure category archives, author feeds, and pagination pages update simultaneously without manual cache clearing.

Deploying edge-level Cache Everything rules transforms standard WordPress hosting into an ultra-fast global web application capable of handling viral traffic spikes with sub-30ms response times.