How Cloudflare-CDN-Cache-Control works

1. What is it?

Cloudflare-CDN-Cache-Control is a response header your origin server sends to give Cloudflare separate caching instructions from what browsers and other intermediaries receive via the standard Cache-Control header.

Its sibling, CDN-Cache-Control, works similarly but is forwarded downstream to other CDNs. Cloudflare-CDN-Cache-Control is consumed only by Cloudflare and is never proxied to the browser.

2. Header hierarchy & precedence

When multiple headers are present, Cloudflare follows this priority order (highest to lowest):

1. Cloudflare-CDN-Cache-Control — Cloudflare-specific; never forwarded downstream
2. CDN-Cache-Control — for any CDN; forwarded downstream to other CDNs
3. Cache-Control — standard header; used by browsers and all intermediaries

3. Cache-Control directives

Cloudflare-CDN-Cache-Control uses the same directives as Cache-Control. Multiple directives are comma-separated.

Cacheability

Expiration

Revalidation

Other

4. Origin Cache Control (OCC) behavior

OCC determines whether Cloudflare strictly follows RFC 7234. Free/Pro/Business customers have it on by default. Enterprise customers can toggle it. When Cloudflare-CDN-Cache-Control is present, OCC is always considered on.

5. Use cases & examples

Different TTLs per cache layer

Cache-Control: max-age=14400
Cloudflare-CDN-Cache-Control: max-age=24400
CDN-Cache-Control: max-age=18000

Different stale-if-error per layer

Cache-Control: stale-if-error=400
Cloudflare-CDN-Cache-Control: stale-if-error=60
CDN-Cache-Control: stale-if-error=200

Common Cache-Control recipes

# Cache a static asset for 24 hours
Cache-Control: public, max-age=86400

# Never cache sensitive content
Cache-Control: no-store

# Cache at CDN only, not in browsers
Cache-Control: private, max-age=3600
Cloudflare-CDN-Cache-Control: public, max-age=86400

# Cache but always revalidate (CDN and browser)
Cache-Control: public, no-cache, must-revalidate

# Cache with background revalidation (stale-while-revalidate)
Cache-Control: max-age=600, stale-while-revalidate=30

# Different edge vs browser TTL
Cache-Control: public, max-age=7200, s-maxage=3600

6. Interactions with other Cloudflare features

7. How to test

Step 1 — Inspect response headers with curl

curl -I https://www.tpimenta.xyz/cache/cloudflare-cdn-cache-control/

Look for these headers in the response:

• CF-Cache-Status — cache result (see table below)
• Age — seconds the asset has been cached at Cloudflare
• Cache-Control — what your origin returned (browser sees this)
• Cloudflare-CDN-Cache-Control — should not appear; Cloudflare strips it

Step 2 — Understand CF-Cache-Status values

Step 3 — Purge cache and verify MISS → HIT cycle

# Purge a specific URL via Cloudflare API
curl -X POST "https://api.cloudflare.com/client/v4/zones/{zone_id}/purge_cache" \
  -H "Authorization: Bearer {api_token}" \
  -H "Content-Type: application/json" \
  --data '{"files":["https://www.tpimenta.xyz/cache/cloudflare-cdn-cache-control/"]}'

# First request after purge — should be MISS
curl -I https://www.tpimenta.xyz/cache/cloudflare-cdn-cache-control/

# Second request — should be HIT (and Age will be > 0)
curl -I https://www.tpimenta.xyz/cache/cloudflare-cdn-cache-control/

Step 4 — Verify Cloudflare isn't forwarding the header

# The Cloudflare-CDN-Cache-Control header must NOT appear in the response
# because Cloudflare strips it before delivery to the client
curl -I https://www.tpimenta.xyz/cache/cloudflare-cdn-cache-control/ | grep -i "cloudflare-cdn"
# Expected output: (empty — header is stripped)

Step 5 — Use Cloudflare Dashboard

• Caching > Cache Rules — inspect or override Edge/Browser Cache TTLs
• Analytics > Cache Analytics — view hit rates and cache status distribution
• Speed > Optimization — confirm Polish / compression settings

8. Troubleshooting: Origin sends Cloudflare-CDN-Cache-Control: max-age=86400 but CF-Cache-Status is DYNAMIC

CF-Cache-Status: DYNAMIC means Cloudflare is not attempting to cache at all — the resource is treated as uncacheable before TTL headers even come into play. Cloudflare-CDN-Cache-Control controls how long to cache, but the resource must first pass Cloudflare's cacheability checks.

Root cause #1 — File extension not in Cloudflare's default cache list (most common)

Cloudflare only caches a fixed set of file extensions by default. It does not cache HTML, JSON, XML, or API responses. If the URL is /api/data, /page.html, or anything returning JSON/HTML — Cloudflare marks it DYNAMIC regardless of headers.

Cached by default: css, js, jpg, png, gif, webp, svg, woff2, pdf, zip, mp4 and other static assets.

NOT cached by default: .html, .json, .xml, API endpoints, and any dynamic content.

Root cause #2 — Origin also sends a Cache-Control that prevents caching

Even though Cloudflare-CDN-Cache-Control takes precedence for TTL, if Cache-Control contains no-store, private, or no-cache, Cloudflare may still refuse to cache depending on OCC settings.

Check both headers at the same time:

curl -I https://www.tpimenta.xyz/cache/cloudflare-cdn-cache-control/ | grep -iE "cache-control|cloudflare-cdn"

If you see a conflicting Cache-Control directive, either fix it at the origin or use a Cache Rule to override it.

Root cause #3 — Set-Cookie header in the origin response

If the origin response includes a Set-Cookie header, Cloudflare will not cache it by default — regardless of any cache TTL headers present.

curl -I https://www.tpimenta.xyz/cache/cloudflare-cdn-cache-control/ | grep -i "set-cookie"

Root cause #4 — Request method is not GET

Cloudflare only caches GET requests. POST, PUT, PATCH, DELETE and all other methods always return DYNAMIC.

Root cause #5 — Request has a Cookie header and Cache Level is Standard

At Standard cache level (the default), requests that include cookies are bypassed for non-static assets. You can change the Cache Level to Ignore Query String or use a Cache Rule to cache regardless of cookies.

Root cause #6 — A Cache Rule is explicitly set to Bypass

An existing Cache Rule with action Bypass cache overrides everything, including Cloudflare-CDN-Cache-Control. Check your Cache Rules in the dashboard for any bypass rules that may match the request path.

Quick diagnostic — run this curl and check all at once

curl -sv https://www.tpimenta.xyz/cache/cloudflare-cdn-cache-control/ 2>&1 | grep -iE \

  "cache-control|cloudflare-cdn|cf-cache|set-cookie|age:|content-type|< HTTP"

Diagnostic checklist