Checking why cookies prevent or alter Cloudflare caching

Choose a representative URL and inspect its request Cookie header, response Set-Cookie and Cache-Control headers. Remove or redact session values before recording diagnostic information.

1. Compare an anonymous request with a signed-in request from separate browser contexts. Record content differences and CF-Cache-Status.
2. Identify whether the response sets a session cookie or declares private/no-store caching. Review Origin Cache Control and any cache overrides.
3. For personalised sessions, create explicit bypass conditions using the application’s actual cookie names or protected paths.
4. For genuinely public assets, investigate unnecessary session creation at the application rather than stripping important cookies globally.
5. Retest the anonymous and authenticated workflows after the change, including login, logout and cart updates.

If your inspection confirms these cookie names belong to the store’s active login and session integrations, a cookie-based Cache Rule can supplement private-path exclusions. Scope it to the intended hostname and choose Bypass cache.

http.host eq "shop.example.com" and (
  http.cookie contains "wordpress_logged_in_" or
  http.cookie contains "wp_woocommerce_session_"
)

The expression checks cookie names and deliberately does not contain a real cookie value. Other plugins and custom applications can use different names, so verify the browser request before relying on this example. Do not strip a session cookie merely to increase the cache hit rate, and review origin page caching separately.

Expected result: An anonymous public page can follow its public policy, while authenticated or session-dependent requests follow the intended bypass. Test login, logout and changing cart contents with separate browser sessions to confirm that no personalised response is shared.

Public content should remain safely reusable, while session-dependent content should retain its correct per-user behaviour. Cache performance is secondary to correct data separation.

Overrides can change how Set-Cookie and origin directives affect storage. A blanket cache-everything rule or cookie-stripping change can break sessions or expose private content. Inspect the effective configuration instead of assuming every cookie automatically protects the response.

Possibly, if it does not change the response or authorisation. Make that decision from the application’s behaviour and exact cookie purpose, while keeping session and access-control cookies protected.

• Bypassing cache for private account and checkout pages
• Interpreting CF-Cache-Status during performance testing
• Creating a cache rule for public static assets
• Controlling query-string caching without mixing different content

• Cloudflare: Cache Control
• Cloudflare: Cache Behavior
• Cloudflare: Bypass Cache On Cookie