Private account, cart and checkout responses must not be shared between visitors. Use explicit cache bypass rules alongside correct application headers and test with distinct user sessions.
IN THIS ARTICLE
What you need before you begin
Inventory private paths, session cookies, authenticated downloads and application endpoints. Include custom login URLs and APIs rather than relying on a generic list copied from another site.
01 Bypass cache for private account and checkout pages
- Create a Cache Rule that matches the intended hostname and private paths or appropriate authentication/session conditions.
- Set the action to Bypass cache. Use separate clear conditions when that makes the rule easier to audit.
- Review its order so a later broad cache rule cannot override the bypass. Check Workers and other caching layers too.
- Purge any private objects that may already have been cached using the correct scope. Fix the application’s Cache-Control headers and origin page-cache exclusions.
- Test signed-out access and two separate signed-in accounts, checking headers and page contents without exposing real customer data.
02 Example: bypass the actual private store paths
For a shop using the standard path names below, this example Cloudflare Cache Rule expression identifies the cart, checkout and account areas. Replace the hostname and paths with those actually used by your store, then choose Bypass cache.
http.host eq "shop.example.com" and (
http.request.uri.path eq "/cart" or
starts_with(http.request.uri.path, "/cart/") or
http.request.uri.path eq "/checkout" or
starts_with(http.request.uri.path, "/checkout/") or
http.request.uri.path eq "/my-account" or
starts_with(http.request.uri.path, "/my-account/")
)This is a path example, not a complete store cache policy. Inventory custom slugs, order confirmations, session cookies, AJAX and API endpoints too. Review rule ordering and the origin’s cache exclusions so another layer does not continue sharing personalised HTML.
Expected result: Two isolated test accounts see only their own cart and account information. The bypass covers both slash variants and relevant nested paths while ordinary public static assets remain separately cacheable.
Confirm the expected result
Private content should come from the correct application session and should not be served as another visitor’s cached page. Public static assets can still use caching independently.
Troubleshoot unexpected results
A CDN bypass does not disable a WordPress cache plugin, server page cache or browser cache. If private data was exposed, stop the affected caching behaviour and investigate the extent rather than merely clearing one browser.
Is checking only the checkout URL enough?
No. Cart fragments, account APIs, order confirmations and authenticated downloads may use different paths or cookies. Test the application’s complete private workflow.
.png)
 (1).jpg)
 (1) (1).png)
 (1).png)
.jpg)
.jpg)
 (1).jpg)
.jpg)
