What the check looks at
C4 requests wp/v2/types from the WordPress REST API with a unique query parameter, and on a site with WooCommerce also one product from the Store API (wc/store/v1/products). The answer to the plugin’s own REST test request counts as a third sample. Each answer is sorted by its cf-cache-status.
The addresses come from WordPress (rest_url()), so a changed REST prefix is measured where WordPress puts it. When WordPress gives the REST API on another host, the plugin measures the REST API under your own Site Address instead and says so in a note.
Like every request Edge Doctor sends, these go only to the hosts of your Site Address and WordPress Address (home_url() and site_url()). An address WordPress gives on another host, such as a single sign on page, is never requested.
Results and what they mean
The plugin sorts the cf-cache-status header Cloudflare returns into classes. HIT, MISS, EXPIRED, STALE, REVALIDATED and UPDATING all mean the response was eligible for the cache, so they count as cacheable; a MISS is a copy that is being stored now. BYPASS means a rule made the request eligible, but the origin response was not cacheable. DYNAMIC means Cloudflare decided at request time that the response is not eligible, which is the normal state for private pages. (Cloudflare: cache responses.)
| Result | What it means |
|---|---|
| PassedConfidence: High | Your API answers are not cached Cloudflare treats the API as dynamic. |
| WarningConfidence: High | A cache rule reaches your API A rule covers the API and is bypassing the cache for now ( BYPASS). Only the headers your server sends keep the answers out. |
| WarningConfidence: High | Cloudflare is caching your API answers An API answer is cacheable. Nothing on the site looks like it keeps personal answers there today, but a nonce in a cached answer stops working once it expires. |
| FailedConfidence: High | Cloudflare is caching your API answers The same on a site with a shop or a membership plugin, where one person’s answer can be handed to another. |
| Could not checkConfidence: High | This check could not be completed The cache key ignores the query string ( qs_ignored). |
| Could not checkConfidence: Low | This check could not be completed Cloudflare did not say what it did, or the requests did not get through. |
| Not applicable | Cloudflare is not in front of this site Check A1 did not detect Cloudflare, so this check sent no request. Reason not_behind_cloudflare. |
When the result names a reason
qs_ignored: Your cache key ignores the query string, so the plugin cannot test a page without risking a cached copy of it. Before it asks for any private address, the plugin requests your home page twice with a different unique query string. If either answer is aHIT, your cache key ignores the query string, and a test request could store a private page under an address visitors use. So the plugin stops and sends nothing.worker: A Cloudflare Worker sits in front of this site, so cache headers do not say what the cache did.loopback_failed: Your server could not reach its own site, so this check had nothing to read. The plugin links this result to its own guide: Your server could not reach its own site.blocked_by_config: WordPress itself refused the requests from your site to itself, so none was sent. WP_HTTP_BLOCK_EXTERNAL is on, and your own address is not let through. The plugin links this result to its own guide: WordPress blocks requests to your own site.not_behind_cloudflare: This site is not behind Cloudflare.
Symptoms you may notice
- A shop’s cart or mini cart shows another person’s items, or stays empty after adding a product.
- Front end features that use the REST API stop working after a while with an invalid nonce.
Why it happens
Cloudflare does not cache JSON by default (Cloudflare: default cache behavior). API answers get cached when a Cache Rule written for the whole site makes them eligible too.
Confirm it by hand
curl -sI "https://example.com/wp-json/wp/v2/types?cachetest=1" | grep -iE "cf-cache-status|cache-control"Run it twice. HIT on the second request means the answer is stored.
How to fix it
In Cloudflare: exclude the REST API from the Cache Rule that covers it:
and not (http.request.uri.path contains "/wp-json/")Sites with plain permalinks reach the API through ?rest_route=; exclude that query as well if you use them.
In WordPress: nothing to change for the cache.
Limitations
Two or three answers are sampled. An endpoint that a plugin adds with its own caching headers can behave differently.
Related checks
- C2 WooCommerce cart, checkout and account in the cache: the shop pages themselves.
- C5 Login cookies and private responses: login cookies and private answers.
- C6 Cached pages older than their nonces: nonces in cached pages.
Sources
Run this check on your own site with Edge Doctor for Cloudflare®, free on WordPress.org.
Edge Doctor for Cloudflare® is not affiliated with or endorsed by Cloudflare, Inc. Cloudflare is a registered trademark of Cloudflare, Inc.