Cache Management

7/23/2026

Introduced Cache Response Rules, a new rule type that runs after an origin server replies but before Cloudflare caches the content. These rules allow for rewriting Cache-Control directives, managing cache-tags, and stripping headers like Set-Cookie, ETag, and Last-Modified from the origin response before Cloudflare's cache sees them. This addresses issues where origin responses inadvertently make assets uncacheable. Cache Response Rules operate in the response phase, complementing existing Cache Rules which operate in the request phase. Supported actions include stripping specific headers, managing cache tags (add, remove, set), and modifying Cache-Control directives (duration, qualified, and boolean).

7/10/2026

Introduced 'Smart Tiered Cache for Public Cloud Regions' which allows users to provide a cloud region hint for origins behind anycast or regional unicast networks. This feature maps public cloud origins to the correct region and selects better primary and fallback upper tiers, improving cache efficiency and reducing latency. It works by fetching IP range files from supported cloud providers (AWS, GCP, Azure, Oracle Cloud) and matching them against latency probing data to determine the optimal upper tier. The feature is configurable via the dashboard, API, and Terraform.

7/6/2026

Introduced Workers Cache, a tiered cache that sits in front of Cloudflare Workers. This allows Workers to act as origins and leverage HTTP caching for server-rendered applications. Key features include configuration via Wrangler, adherence to `Cache-Control` headers, programmatic purges by tag or path prefix, support for `stale-while-revalidate` for background cache refreshes, and `Vary` header support for content negotiation.

4/17/2026

Introduces support for shared compression dictionaries, specifically delta compression, based on RFC 9842. This allows browsers to use previously cached versions of resources as dictionaries to compress subsequent requests, sending only diffs. This is crucial for managing the increased frequency of deploys driven by agentic web development and agentic crawlers. The implementation involves new HTTP headers (`Use-As-Dictionary`, `Available-Dictionary`) and content encodings (`dcb`, `dcz`). Cloudflare's initial phase provides passthrough support, ensuring correct caching behavior by varying cache keys on `Available-Dictionary` and `Accept-Encoding`.

4/2/2026

This post introduces the concept of rethinking web cache design for the AI era, driven by the observation that AI traffic (crawlers, assistants) exhibits different patterns than human traffic. It details how AI traffic, characterized by high unique URL ratios, content diversity, and crawling inefficiency, leads to increased cache miss rates and churns existing caches. The post proposes AI-aware caching strategies, differentiating between AI applications requiring low latency and content collection jobs that can tolerate higher latency, suggesting the use of different cache tiers or admission control mechanisms.

2/3/2026

Introduced 'Local Uploads' for R2 object storage, allowing data to be written to a storage location close to the client first, then asynchronously copied to the bucket's region. This reduces upload request duration (TTLB) by up to 75% for cross-region uploads. The implementation uses Cloudflare Queues for asynchronous replication tasks and a pull model with a centralized polling service and Gateway Worker for execution. Local Uploads are available for non-jurisdiction restricted buckets.

5/22/2025

This post details the discovery and mitigation of an HTTP/1.1 request smuggling vulnerability in the Pingora OSS framework, specifically within its caching component. The vulnerability arose from a parsing bug where, on a cache hit, unread request bodies could be misinterpreted as the start of a subsequent request, leading to potential request hijacking and cache poisoning. Cloudflare mitigated this by disabling traffic to vulnerable components, releasing a patch (Pingora 0.5.0+), and invalidating cached assets.

5/8/2025

Introduces a direct integration of Google tag gateway for advertisers, enabling first-party serving of Google tags from Cloudflare-proxied domains. This simplifies setup to a one-click process, improves performance and measurement accuracy by rerouting requests through the user's domain, and ensures cookies are set under the website's domain. The integration leverages Cloudflare's reverse proxy capabilities to fetch Google tag JavaScript files and serve them to the end user's browser from the customer's domain.

4/9/2025

This post announces the General Availability (GA) of Cloudflare Snippets, a feature that allows users to control HTTP traffic using JavaScript code rules. It highlights key capabilities such as dynamic header modification, URL rewriting, request retries, and caching. The post details the evolution of Snippets from announcement to GA, including significant traffic growth and new features like a code editor and integration with Secrets Store. It also clarifies the distinction between Snippets and Cloudflare Workers, providing use cases and code examples for dynamic header modification, serving custom maintenance pages, retrying failed requests, and redirecting users based on location. The integration with Cloudflare Trace for debugging is also noted.

4/3/2025

Introduces the Images binding for Cloudflare Workers, enabling programmatic image transformation, overlaying, and encoding directly within the Workers platform. This binding decouples image optimization from delivery, allowing for more flexible workflows, including transforming images not accessible via URL and chaining multiple transformations without intermediate delivery. It also introduces a new way to specify optimization parameters, allowing for more flexible ordering. Local development support is provided via online and offline modes in Wrangler.

4/1/2025

This post details the complete rebuild of Cloudflare's cache purge pipeline, introducing an active purge system using RocksDB (CacheDB) integrated with cache proxies. This architecture reduces storage requirements by 10x, improves throughput, and enables all purge methods (URL, hostname, tag, prefix, everything) to be available to all customers with sub-150ms purge times. It also details the new token bucket rate limiting system for purge requests across different plans.

2/7/2025

This post details an incident where Cache Reserve experienced increased origin requests due to the unavailability of R2, its underlying storage. While Cache Reserve itself did not fail, customers saw an increase in requests to their origin servers as assets became unavailable in Cache Reserve during the R2 outage. This highlights the dependency of Cache Reserve on R2 and the cascading impact of R2 failures on other services.

12/26/2024

Introduces a probabilistic cache revalidation strategy as an alternative to traditional cache locks. This involves simulating a die roll for each request to determine if it should go to the origin when the cache is stale, aiming to reduce origin load and prevent cache stampedes. The post details the implementation using Cloudflare Workers and the Cache API, and explores the mathematical expectancy of revalidation requests under different probabilities and request rates.

9/26/2024

Introduced direct binding between Workers KV and KV Workers, bypassing Front Line layers to reduce latency by ~20ms. Implemented Tiered Cache for Workers KV to resolve ~30% of requests regionally. Added an in-memory cache for the hottest KV keys, resolving them in under a millisecond.

9/25/2024

This post details the technical advancements in Cloudflare's cache purge system, specifically focusing on achieving sub-150ms global purge latency for tags, hostnames, and prefixes. It explains the transition from a "lazy purge" mechanism to a new distribution system that leverages Quicksilver for efficient propagation of purge requests across the global network. The post also discusses the challenges of flexible purges (by tags, hostnames, prefixes) and how the new architecture addresses them, including the need to store purge requests beyond maximum eviction age and the storage implications. It highlights the performance improvements and the upcoming expansion of flexible purge options to lower-tier plans.

9/10/2024

Introduced a new open-source Rust crate, 'trie-hard', which implements a highly optimized trie data structure. This crate was integrated into the pingora-origin service to replace a less efficient header removal mechanism, resulting in a significant reduction in CPU utilization (from 1.71% to 0.34% in production sampling) and a corresponding increase in request processing capacity. The trie-hard crate achieves its performance gains by storing node relationships in bits of unsigned integers and keeping the tree in contiguous memory.

2/29/2024

This post introduces an alternative endpoint for polyfill.io hosted on Cloudflare's cdnjs, addressing supply chain risks associated with the original provider. It details the deployment of the polyfill.io service on Cloudflare Workers using Rust, with polyfill files stored in Cloudflare D1 for efficient retrieval. The post also provides a Cloudflare Worker example for automatically rewriting links to the new cdnjs endpoint and highlights the use of Cloudflare's Rust API for metrics and logging.

2/8/2024

This post investigates the performance implications of using one versus two source IPv4 addresses for cache egress, specifically analyzing the `tcp_v4_connect()` syscall. It identifies a performance bottleneck in the Linux kernel's `__inet_hash_connect()` function, attributing the latency to the port selection algorithm's parity-based iteration. The post details experimental findings using `wrk` and `funclatency` tools, and a custom benchmark, to demonstrate the bimodal distribution of connection latencies and the significant performance difference between even and odd port selection. It also provides a deep dive into the `__inet_hash_connect()` algorithm and its port selection logic, highlighting the impact of the `IP_LOCAL_PORT_RANGE` socket option.

10/25/2023

Cache Reserve has graduated to General Availability (GA). New features include: 1. Integration into the Cache overview analytics dashboard, showing storage, operations, and estimated egress savings over time. 2. A 'delete storage' button to remove all data in Cache Reserve without affecting the edge cache. 3. Integration into Cache Rules, allowing granular control over which assets are eligible for Cache Reserve storage, moving beyond the default of caching all eligible assets.

10/24/2023

Introduces Cache Rules as generally available (GA) with new configuration options: defining Cache Reserve eligibility, setting origin timeout values, specifying custom cache ports, and controlling cache bypass without a cache-control header. Details the technical limitations of Page Rules (regex transformation, rule count limits) and how the Rulesets Engine addresses these by evaluating rules conditionally. Provides examples of using Cache Rules for content updating cadences and handling slow origins.

10/12/2023

This post details Prisma's migration from AWS S3 + CloudFront to Cloudflare R2 for distributing their ORM engines. It highlights the cost savings (98% reduction) and performance parity achieved by leveraging R2's object storage and Cloudflare's global network. The migration strategy involved a gradual DNS rollout with load balancing and health checks to ensure zero downtime. The technical details include the scale of engine downloads (100 million/month, 250TB egress), the comparison of distribution options (GitHub, npm, other CDNs), and the testing methodology used to validate R2's performance.

10/4/2023

Introduced multi-host and path coverage for Cloudflare Waiting Room, allowing a single waiting room to protect multiple hostname and path combinations. This enables broader site protection and simplifies multi-language setups by allowing different language templates to be served based on URL path or hostname. The feature is available to Enterprise customers with an Advanced Purchase of Waiting Room.

9/28/2023

Introduced build caching for Cloudflare Pages, allowing for the caching of dependencies (npm, yarn, pnpm, Bun) and build outputs for frameworks like Gatsby.js, Next.js, and Astro. This feature aims to reduce build times by reusing cached artifacts and only computing modified sections of the code.

9/26/2023

Introduced Sippy, an incremental migration service for copying data from S3 to R2. Sippy leverages application requests to copy objects to R2 simultaneously when they are requested from S3, thereby reducing egress fees. It works by serving objects from R2 if found, and if not, returning them from S3 while also copying them to R2. This allows for gradual migration and cost savings. The post also details how to enable Sippy via API and suggests pairing it with Super Slurper for full migration completion.

9/26/2023

This post announces the merging of Cloudflare Images and Image Resizing into a single product. The primary technical changes involve a new pricing model for image transformations, billing based on unique transformations per month ($0.50 per 1,000 unique transformations) rather than uncached requests, and the introduction of a zero-storage plan for image resizing. Existing Image Resizing customers can opt into the new pricing model.

9/25/2023

Introduced Cloudflare Fonts, a feature that rewrites HTML on the fly to serve Google Fonts from the customer's own domain. This eliminates third-party requests to Google, enhancing privacy by not sharing user data like IP addresses and user agents. It also significantly improves performance by reducing DNS lookups, socket connections, and TLS negotiations from eight round trips to one, by embedding CSS and transforming font URLs. The feature leverages the ROFL (Response Overseer for FL) module, written in Rust, for efficient HTML alteration during streaming. Fonts are cached within Cloudflare's infrastructure, and Fontsource/NPM are used for loading and caching. This resulted in a significant reduction in First Contentful Paint (FCP) and an improvement in Lighthouse performance scores.

9/4/2023

This post details the research and prototyping of connection coalescing using HTTP/2 ORIGIN Frames. It explains the problem of excessive DNS queries and connections for web page rendering, and how ORIGIN Frames can be used as an explicit signal from servers to clients to enable the reuse of existing TLS connections for different hostnames. The post outlines the two required steps: sending an ORIGIN Frame with an origin-set and ensuring these hostnames are in the TLS certificate's SAN list. It contrasts this with IP-based coalescing and highlights the benefits of reduced latency, improved security by limiting metadata exposure, and simplified management for CDN operators.

7/10/2023

Cloudflare Images and Image Resizing products now include specific logic to detect and prevent the re-encoding of images containing trailers, which can expose sensitive data due to vulnerabilities like aCropalypse. This is achieved by parsing JPEG and PNG file structures to identify data beyond the end-of-image marker. For JPEGs, this involves using libjpeg-turbo to check for remaining bytes after consuming the EOI marker. For PNGs, a custom parser iterates through chunks until the IEND chunk is found, checking for any remaining data. This ensures that affected images are always re-encoded, thereby mitigating the vulnerability without requiring changes to customer origin images or introducing latency.

6/23/2023

This post introduces end-to-end Brotli compression support, enabling origins to serve Brotli-compressed assets at the highest compression level (11). It details the technical implementation of a Brotli decompressor integrated into Cloudflare's core reverse web proxy and Workers runtime, allowing for the preservation of origin compression levels when specific features like Email Obfuscation, Rocket Loader, SSE, Mirage, HTML Minification, and Automatic HTTPS Rewrites are disabled or managed via Configuration Rules. Additionally, it announces Compression Rules for Enterprise Customers, providing granular control over which content types and file extensions are compressed, and how.

6/23/2023

Introduced Ricochet for API Gateway, a feature that enables intelligent caching of API requests, including previously un-cacheable types like GraphQL POST requests. Ricochet automatically reduces average latency by caching API requests that would otherwise go to origin, without requiring origin changes. It uses API session identifiers or hashes of request parameters to construct secure cache keys, ensuring data privacy. The feature also automatically invalidates cache entries when non-safe HTTP methods (POST, PUT, DELETE) are used for a RESTful endpoint managed by API Gateway.

6/21/2023

This post details the architecture of Cloudflare's new 'coreless' cache purge system. It describes the end-to-end flow of a purge request, including the roles of API Gateway workers, Purge Ingest workers (performing local validation and cache key generation), Purge Queue workers (Durable Objects for managing global purge queues and data center progress), and Purge Fanout workers (regional distributors). Key improvements include local validation to filter invalid purges, broadcasting cache keys instead of full purge requests, regional autoscaling for Durable Objects, and the use of fanout workers to reduce inter-region communication latency and improve throughput. The system is in production for purge-by-URL requests and benefits flexible purges through edge validation.

6/21/2023

Introduced the Cloudflare Migration Hub, a central resource for migrating to Cloudflare services. Relaunched Turpentine, a tool for translating VCL to Cloudflare Workers. Added new migration guides comparing Cloudflare features to Akamai and Fastly, with code examples. Established a Professional Services group to assist customers with complex migrations. Highlighted success stories of cost savings and improved reliability after migrating from Akamai and other vendors.

6/21/2023

This post details how Kinsta used Cloudflare Workers and Workers KV to improve their cache hit rates by 56%. They implemented programmatic cache key customization by appending dynamic parameters based on Workers KV data to the request URL. This allowed them to reflect client-side configuration changes (like Polish and Auto Minify settings) in the cache key, ensuring that updated assets were served without manual cache purging. Additionally, they implemented microcaching of Workers KV data itself with a short TTL (30 seconds) to reduce read operations and latency.

6/19/2023

This post introduces 'Smart Hints,' a new feature that automates the application of Early Hints and Fetch Priorities. It leverages Cloudflare's network, Real User Measurements (RUM), and heuristics to dynamically determine optimal resource prioritization for web assets, eliminating the need for manual configuration by developers. The goal is to improve page load performance by intelligently suggesting how browsers should load resources.

6/1/2023

This post announces the deprecation of Cloudflare Railgun, a delta compression technology for accelerating dynamic content. It explains the reasons for deprecation, including maintenance burden and the availability of superior alternatives. The post recommends migrating to Cloudflare Tunnel for persistent, secure connections without public IPs, Argo Smart Routing and Cloudflare Network Interconnect for performance improvements, and R2 storage or Bandwidth Alliance partners for reducing egress fees. The deprecation timeline is set for January 31, 2024.

6/1/2023

Introduced Regional Tiered Cache, a new tier within the existing Tiered Cache offering. This feature adds a middle-tier in each region that lower-tier data centers query first on a cache miss, before querying a distant upper-tier. This is particularly beneficial for customers using Smart Tiered Cache or custom topologies with upper-tiers in one or two regions, aiming to reduce latency for global traffic by improving cache hit rates and reducing origin egress.

5/16/2023

This post introduces Cloudflare R2 as a solution for storing large datasets and model checkpoints for AI model training, specifically highlighting its zero-egress pricing model. It demonstrates how R2, when combined with MosaicML's tools (StreamingDataset and Composer), enables flexible and cost-effective training of large language models across multiple cloud providers without incurring prohibitive data transfer fees. This significantly enhances the utility of R2 beyond traditional caching by enabling it as a foundational storage layer for computationally intensive AI workloads.

5/16/2023

Introduced the general availability of R2 Super Slurper for one-time data migration from S3 to R2. Enhanced speed (up to 5x increase in objects copied per second), reliability (robust retries, chunked transfers for larger objects), and added the ability to copy data between R2 buckets. Also announced the upcoming private beta for incremental migration, which copies files from origin to R2 as they are requested.

5/10/2023

Introduced Object Lifecycle Management for Cloudflare R2, enabling users to define rules for object expiration and aborting incomplete multipart uploads. This feature can be configured via the R2 dashboard or the S3-compatible API, with examples provided for both.

12/30/2022

This post details the significant advancements in HTTP protocols during 2022, including the publication of HTTP/3 and its underlying QUIC protocol, the republication of core HTTP specifications (Semantics, Caching, HTTP/1.1, HTTP/2), and the exploration of Early Hints (RFC 8297) for performance improvements. It also covers new privacy-focused intermediation specifications like MASQUE (RFC 9298) and Oblivious HTTP (OHTTP), and security enhancements with Digest Fields and HTTP Message Signatures. The post highlights Cloudflare's participation in these developments and their integration into Cloudflare products.

11/15/2022

Introduced the R2 Super Slurper, a feature to migrate data from S3-compatible object storage to Cloudflare R2. It offers two modes: a one-time 'giant slurp' for bulk imports and a future 'sip by sip' incremental migration where objects are copied to R2 upon their first request. The 'sip by sip' flow involves checking R2, fetching from origin if not found, serving from R2, and then copying to R2 for subsequent requests.

11/15/2022

Introduced Cache Reserve as an open beta feature, acting as an ultimate upper-tier cache leveraging R2 storage. Cache Reserve stores content for longer periods (default 30 days) to reduce cache eviction and origin egress fees, especially for long-tail content. It is built on Cloudflare's developer platform (Workers, Durable Objects) and integrates with Pingora and Tiered Cache. The post details the architecture of Cache Reserve, including how it writes to R2 on cache misses and serves content from R2 on subsequent requests, sharding assets across buckets for load distribution.

10/26/2022

This post details an incident where a change to the distributed tracing logic within Cloudflare's Tiered Cache system caused a significant outage. The bug, introduced by wrapping the `go()` function with `trace_fn()`, inadvertently cleared control headers essential for internal DNS lookups, resulting in 530 errors. The incident response involved identifying the root cause, confirming it through a rollback, and executing an accelerated global rollback. Remediation steps include incorporating larger data centers into earlier release stages, expanding acceptance test coverage for Tiered Cache topologies, improving alerting for requests lacking full context, and ensuring systems fail fast in error scenarios.

10/7/2022

This post introduces the integration of Early Hints with Cloudflare Pages. It explains how Early Hints work by sending `preload` and `preconnect` Link headers as a 103 Early Hints response before the full HTML response, allowing browsers to start loading critical resources sooner. The post details performance testing results showing significant reductions in LCP and document load times. It also explains how to enable Early Hints on Pages, including automatic support for `pages.dev` domains and manual enablement for custom domains, as well as the ability to transform `<link>` HTML elements into `Link` headers.

9/27/2022

Introduced Dynamic Redirects, a new feature built on the Rulesets Engine, enabling URL redirection based on a wide range of request parameters (e.g., country, language) beyond just the URL. This complements existing features like Bulk Redirects and Transform Rules, offering more dynamic and granular control over traffic routing without requiring custom code. The feature leverages the Rulesets Engine's extensive field set and logical operators for filtering, and provides a dedicated quota separate from Page Rules.

9/27/2022

Introduced Cache Rules as a successor to Page Rules for cache management. Cache Rules allow for more granular control over caching by matching on URL, HTTP request headers (e.g., content-type, cookies, user-agents, hostnames), and file types, with support for AND/OR operators. This provides enhanced flexibility and precision compared to the URL-only matching of Page Rules. The post also highlights the separation of Page Rules into four distinct rule sets (Origin Rules, Cache Rules, Configuration Rules, Redirect Rules) to improve clarity and reduce debugging time. Increased visibility into rule application precedence and interaction with other Cloudflare products is a key improvement. Cache Rules are available in beta via API, Terraform, or UI.

9/27/2022

This post introduces Configuration Rules as a successor to Page Rules. Configuration Rules significantly enhance granular control over Cloudflare features by allowing users to apply settings based on a wider range of HTTP request attributes (URLs, cookies, country of origin, etc.), not just URLs. This enables advanced use cases like A/B testing of features and more nuanced security configurations, moving beyond the limitations of Page Rules.

9/27/2022

This post announces the replacement of Page Rules with four new dedicated products: Cache Rules, Configuration Rules, Dynamic Redirects, and Origin Rules. Cache Rules specifically address the 'everything caching' aspect previously handled by Page Rules, offering increased rules quota and more granular control over caching behavior. The new products are built on the Rulesets Engine, providing a more scalable and extensible architecture.

9/27/2022

This post introduces Origin Rules, a new product that allows for overriding the host header, Server Name Indication (SNI), destination port, and DNS resolution of matching HTTP requests. This directly addresses the complexity of routing traffic to different origins, especially for SaaS platforms and applications listening on non-standard ports, by providing a no-code solution that previously required custom code (Workers, Spectrum) or self-managed reverse proxies. It enhances cache management by enabling more sophisticated origin selection, including routing to cloud storage endpoints like S3-compatible buckets, and supports advanced use cases like A/B testing different cloud providers and routing users to the closest storage instance.

9/21/2022

This post introduces the capability to store and retrieve Cloudflare logs directly on Cloudflare R2 object storage. It details the cost benefits of using R2 for logs, including no egress fees and centralized storage. It provides API examples for configuring Logpush jobs to R2 and for retrieving logs from R2 using the Log Retrieval API. The post also mentions future plans for log analysis and forensics capabilities on R2.

9/21/2022

Introduced SVG support to Cloudflare Images, requiring the development of a security filter to sanitize SVGs by removing scripting, hyperlinks, and cross-origin references. This filter is open-source, written in Rust, and operates in a streaming fashion. SVG files are now served without server-side resizing, and variants are disabled for them in the UI.

9/21/2022

This post announces the general availability of R2, Cloudflare's object storage service, highlighting its key features: S3 compatibility, automatic region selection, deep integration with Cloudflare Workers, presigned URLs, public bucket support, and transparent pricing (no egress fees). It marks a significant expansion of Cloudflare's data storage and management capabilities, directly impacting cache management by offering a cost-effective alternative to traditional object storage and enabling new patterns for data access and edge compute integration.

9/15/2022

This post details the technical implementation of using Cloudflare R2 as a backend for apt/yum repositories. It explains how to create .deb/.rpm packages, generate repository metadata files (Release, Packages), upload these files to R2 in a structured format, and serve them via a lightweight Cloudflare Worker. The post provides code examples and links to relevant tools and scripts used in Cloudflare's production environment for distributing cloudflared.

7/12/2022

Introduced Waiting Room Event Scheduling, allowing users to schedule changes to Waiting Room settings and custom queueing pages ahead of time for online events. Added new queuing methods: Reject (presents a static HTML page to offload traffic) and Passthrough (allows unrestricted access). Introduced pre-queuing to hold visitors before an event starts, with an option to shuffle the pre-queue for fairness. Enhanced the Waiting Room dashboard to display upcoming and live events.

7/8/2022

This post details the impact of Automatic Signed Exchanges (SXG) on website performance, presenting internal measurements showing significant improvements in LCP, FCP, and TTFB for a majority of customers. It also announces the expansion of SXG support to Chromium-based desktop browsers and the introduction of Dynamic SXG to handle server-side personalization by annotating pages with 'Vary: Cookie'.

6/23/2022

This post details the integration and performance impact of Early Hints, a feature that leverages HTTP 103 status codes and Link headers to send resource hints to the browser before the full server response is compiled. It explains how Early Hints reduce server 'think time' by enabling the browser to preload resources and initiate preconnect connections. The post highlights Cloudflare's role in caching and emitting Early Hints from its edge network, reducing transit latency. It also presents lab testing results demonstrating significant improvements in First Contentful Paint (FCP) and Largest Contentful Paint (LCP) across various network conditions, and mentions collaboration with Google and Shopify for development and testing.

5/14/2022

This post details the engineering challenges and current performance benchmarks of Cloudflare's global cache purge system. It breaks down the difficulties in achieving scale, speed, and precise scope for cache invalidation. The post then benchmarks the existing purge pipeline across various regions and purge types (URL vs. others), providing P50, P75, and P99 latency figures in seconds for different regions and global averages. This serves as a baseline analysis for future improvements to the purge system.

5/13/2022

Introduced the Cloudflare Images Sourcing Kit, a new capability that allows users to define one or more external repositories (initially AWS S3 buckets) for bulk importing images into Cloudflare Images. This kit enables reuse of source definitions, import of only new images, validation of image files, definition of target paths and filenames, and provides logs for bulk operations. Future plans include support for Azure Storage Accounts and Google Cloud Storage, as well as a CLI interface.

5/11/2022

This post announces the open beta of Cloudflare R2, an object storage solution designed to eliminate egress charges. It details R2's internal and external APIs (In-Worker API and S3-compatible API), its features including object size limits and strong consistency, and its pricing model with a forever-free tier. Future plans focus on performance improvements, global distribution, and feature expansion such as TTL support, public buckets, pre-signed URLs, and integration with Cloudflare's cache.

5/11/2022

Introduced Cache Reserve, a new persistent data store implemented on top of R2, acting as an ultimate upper-tier cache. Cache Reserve ensures all cacheable content is served from Cloudflare's global cache indefinitely, complementing existing popularity-based caching (LRU) by preventing eviction of less-requested content. It reduces origin egress fees and improves response performance by minimizing origin requests. Cache Reserve respects cache-control headers and purge requests for content updates.

5/11/2022

This post introduces the capability for Cloudflare enterprise customers to use Logpush to store logs on R2. It highlights the cost savings compared to traditional object storage (e.g., S3) and provides an example of potential savings for a high-traffic website. It also mentions upcoming features like a Log Retrieval API and new log datasets (Network Analytics Logs, Worker's Trace Events), log filtering, and custom log formatting.

12/16/2021

This post details the engineering behind Cloudflare's Crawler Hints product. It explains how cache misses from Cloudflare's global CDN network are captured, processed, and used to generate a content freshness score. The system utilizes Kafka for buffering cache miss data, Redis as a distributed buffer for aggregation and deduplication, and a dispatcher service to send batches of URLs to search engine partners via the IndexNow API. The post highlights the challenges of scaling such a system, including handling high traffic volumes, ensuring data deduplication and batching, and implementing customer opt-in mechanisms for rollout.

12/13/2021

Introduced Bulk Redirects, a new product for managing hundreds of thousands of URL redirects via the dashboard. This feature allows for uploading redirect lists via CSV, supports 301, 302, 307, and 308 status codes, and allows specifying destination ports. It aims to simplify URL redirect management at scale, overcoming the limitations of Page Rules (125 redirects) and the coding requirement of Cloudflare Workers for this specific functionality.

10/18/2021

Introduced support for the IndexNow protocol within Crawler Hints, enabling websites to notify search engines about content creation, updates, or deletions. Made Crawler Hints generally available to all Cloudflare customers for free, accessible via a single button click in the Cache tab of the dashboard. This aims to increase the proportion of relevant crawls and limit unnecessary ones, improving customer experience and reducing origin server load.

10/15/2021

This post introduces a novel method for passively measuring and predicting CDN latencies. It details a two-step process: first, predicting Anycast catchments by compiling CDN network footprints from various data sources (ISPs, PeeringDB, IXP databases, BGP data) to infer routing paths and data center usage. Second, estimating CDN path latencies by utilizing Cloudflare's own passive RTT measurements as a proxy. This approach aims to overcome the limitations of active measurements by inferring performance characteristics that cannot be directly observed, thereby enabling better understanding of CDN performance and validation of network models.

10/15/2021

This post details the scaling challenges and architectural evolution of Cloudflare's Geo Key Manager service. It describes how increased demand, particularly from API traffic and geographical data residency requirements (like GDPR), led to performance degradation and TLS handshake failures. The post explains the interaction between the initial TLS termination service, keynotto (a Rust-based key signing service), and gokeyless (a Go-based Keyless SSL keyserver). It highlights issues like head-of-line blocking in keynotto's connection handling and the architectural decisions made to optimize RSA key signatures using Rust and BoringSSL, contrasting it with Go's performance characteristics. The post also touches upon the use of worker pools in gokeyless and the decision to move gokeyless to BoringCrypto for FIPS validation.

10/13/2021

This post introduces and studies the feasibility and benefits of Connection Coalescing, a technique that allows subresources from different hostnames to be fetched over the same TLS connection. It details the privacy and performance benefits, potential risks, and presents a real-world experiment demonstrating that enabling coalescing reduced TLS connections to cdnjs by approximately 78% in Chrome and 22% in Firefox for experiment group sites. The experiment involved serving cdnjs and study sites from the same IP address with compatible TLS certificates to signal browsers for coalescing.

10/12/2021

Introduces the SSL/TLS Recommender tool, which guides users to stronger SSL/TLS configurations for the backend connection from Cloudflare to origin servers. It details the various SSL/TLS encryption modes (Off, Flexible, Full, Full (strict), Strict) and explains the importance of securing the backend connection, addressing issues like partial HTTPS support and content inconsistencies between HTTP and HTTPS.

10/7/2021

Introduced random queueing as an alternative to FIFO queueing for Cloudflare Waiting Room. This new method selects users randomly from the queue, providing a fair chance for all participants, especially beneficial for short-lived, high-demand events. The implementation maintains the underlying FIFO structure, allowing for seamless transitions between queueing methods and preserving user arrival order when switching back to FIFO.

9/17/2021

This post details a benchmarking experiment using Real User Measurement (RUM) data to compare Cloudflare's network performance against Akamai, Amazon CloudFront, Fastly, and Google. It describes the methodology, including the use of the Resource Timing API, measurement of TCP connection time, TTFB, and TTLB, and the analysis of mean and p95 percentiles across approximately 21,000 ASNs. The results indicate Cloudflare's #1 position in most performance metrics, driving further optimization efforts.

9/16/2021

This post introduces Cloudflare's implementation of Early Hints, a web standard utilizing the HTTP 103 Early Hints status code. It explains how Cloudflare leverages its edge network to serve these hints on behalf of origin servers, allowing browsers to asynchronously fetch critical resources during server 'think time'. This reduces page load times, particularly for first-time visitors, by enabling parallelization of resource fetching and page rendering. The post contrasts Early Hints with HTTP/2 Server Push, highlighting Early Hints' 'hinting' approach and its ability to work with 'rel=preload' and 'rel=preconnect' for improved performance.

9/15/2021

Introduced Cloudflare Images as a unified product for storing, resizing, optimizing, and serving images. This product eliminates the need for multiple vendors and associated egress costs. It introduces 'variants' for on-the-fly image manipulation and provides direct upload APIs for developers. Pricing is based on stored and delivered images, with no additional resizing, compute, or egress costs.

9/15/2021

This post introduces Cloudflare Images as a new product that simplifies image pipelines for customers. It addresses customer pain points such as egress fees, fragmented storage solutions (multiple buckets), slow load times due to unoptimized images, and high maintenance overhead. Cloudflare Images offers zero egress costs, a unified storage solution, automatic image variant generation, and on-the-fly optimization based on browser capabilities. It provides APIs and a dashboard for uploading, deleting, updating, and resizing images, minimizing engineering effort required for image management.

9/14/2021

This post announces the free distribution of Tiered Caching to all customers and the introduction of Orpheus. Tiered Caching divides data centers into lower and upper tiers to reduce origin requests and improve cache hit ratios, achieving a 60% or greater reduction in cache miss rates. Orpheus routes around internet problems to ensure origin reachability, reducing 522 errors and improving origin reachability by 23%. Smart Tiered Cache dynamically selects the best upper tier for origins based on performance data.

9/13/2021

This post introduces support for the HTTP `Vary: Accept` header specifically for images. It explains how this header enables Cloudflare's cache to serve different image variants (like WebP or AVIF) based on the browser's `Accept` header, preventing the delivery of unsupported image formats and improving performance by leveraging edge caching for these variants. It also details how to configure this feature via the Cloudflare API and discusses related image optimization tools.

7/28/2021

Introduced Smart Edge Revalidation, a feature that automatically generates `Last-Modified` headers for cached objects when origins fail to provide `ETag` or `Last-Modified` headers. This enables efficient revalidation of expired cache entries, reducing unnecessary origin fetches, bandwidth consumption, and improving user-perceived performance.

5/21/2021

Introduced CDN-Cache-Control and Cloudflare-CDN-Cache-Control response headers to provide granular control over CDN caching behavior, independent of origin caches and browser caches. Detailed header precedence rules and interactions with existing Cloudflare features like Edge Cache TTL and Browser Cache TTL Page Rules. Provided examples of how Acme Corp and ABC Industries can leverage these new headers for more precise cache management.

4/8/2021

Introduced Transform Rules, a new feature allowing administrators to create URL rewrite rules at the edge. This enables dynamic and static rewrites of URI Paths and Queries, improving SEO, security, and user experience. Also introduced URL Normalization to prevent bypasses of security rules via URL encoding and simplify traffic processing.

3/19/2021

This post details the removal of a long-standing caching quirk where requests with query strings required three misses before being cached. Through A/B testing, Cloudflare validated that caching on the first request for URLs with query strings resulted in a minor, acceptable increase in disk writes (2.5%) while improving cache hit rates by approximately 3% for Enterprise customers and reducing origin bytes served by 5%. This data-driven decision was made possible by re-evaluating older assumptions about query string requests being predominantly 'one-hit-wonders' and recognizing that newer mechanisms like transient cache were more effective at managing unpopular assets.

3/16/2021

This post reports on the post-launch performance of Automatic Platform Optimization (APO) for WordPress, demonstrating its effectiveness through data analysis using WebPageTest and Chrome User Experience Report (CrUX). It shows significant improvements in TTFB, First Paint, FCP, and LCP metrics across desktop and mobile devices. The post also details feature enhancements released since APO's launch, including smart caching for marketing query parameters, improved cache hit ratios by checking Accept and Content-Type headers for all GET and HEAD requests, enhanced security against cache poisoning, and improved Page Rules integration.

2/18/2021

Introduced 'Smart Tiered Cache Topology' which dynamically selects the single best upper-tier data center for an origin using Argo performance and routing data. This replaces the static collection of upper-tier data centers previously used. Provides tiered cache analytics showing performance, cost benefits, cached hits, hit ratio, and bytes saved.

2/18/2021

Introduced 'Smart Topology' for Tiered Cache, which automatically configures the optimal topology by identifying the single best data center for origin requests based on latency probing. Implemented a leaderboard algorithm that selects the best and second-best proxying data centers based on 24-hour median latency, with a fallback mechanism for Anycast networks and a check for physically impossible latency observations.

11/25/2020

This post details the migration of Quicksilver, a core distributed data store, from Kyoto Tycoon to a new system. It describes the implementation of QSKTBridge for parallel replication and phased rollout, the challenges encountered with replication saturation due to bootstrapping and I/O saturation from aging SSDs, and the performance improvements observed after migrating the FL component to Quicksilver. It also discusses the evolution of replication topology management from static Salt configurations to dynamic DNS-based approaches.

11/11/2020

This post details an internship project that improved Brotli compression ratios for web content by optimizing the use of its static dictionary, particularly for compression levels 5-9. The approach involved generating specialized, reduced dictionaries for HTML, CSS, and JavaScript based on content type hints and employing fast dictionary lookup data structures like radix tries, hash tables, and bloom filters. This optimization aims to improve compression at a negligible performance cost.

10/2/2020

Introduced Automatic Platform Optimization for WordPress, a Cloudflare service that runs at the edge using Cloudflare Workers. This service provides zero-config edge caching for HTML content, combining Cloudflare's CDN cache with Workers KV to improve cache cold starts globally. It also enables the development of edge-deployed WordPress plugins and optimizes Google font loading. The implementation details include custom headers (`cf-edge-cache`) for origin communication and logic for cache invalidation based on various conditions and headers (ETag, Last-Modified, Date) when the WordPress plugin is not used.

10/2/2020

Introduced Automatic Platform Optimization (APO) for WordPress, leveraging Cloudflare Workers to cache dynamic content (including HTML) at the edge. This service aims to reduce origin requests and processing time, leading to significant improvements in TTFB, FCP, and Speed Index for dynamic websites. APO is integrated via the Cloudflare WordPress plugin and offers a simplified approach to achieving static-site-like performance for dynamic platforms.

9/17/2020

This post details the integration of the Internet Archive's Wayback Machine with Cloudflare's Always Online service. This partnership allows Always Online to serve archived copies of webpages when a customer's origin server is down, enhancing website availability and contributing to the Internet Archive's mission. The integration involves sharing hostname and popular URL information with the Internet Archive for crawling and archiving, and when an origin error occurs (520-527 status codes), Cloudflare first checks its local cache and then fetches the most recent archived version from the Internet Archive to serve to visitors, displaying a banner to indicate the origin is unreachable.

9/10/2020

This post details the migration of cdnjs from a traditional origin server infrastructure to a serverless architecture utilizing Cloudflare Workers and Workers KV. Key technical contributions include: 1. Replacing disk-based storage with a globally distributed key-value store (Workers KV) for static assets. 2. Addressing Workers KV's 10MiB value limit by pre-compressing assets (Brotli and gzip) to optimize storage and bandwidth. 3. Re-architecting the contribution process with a new GitHub repository (cdnjs/packages) and an automated bot for validation and updates, improving security and maintainability. 4. Implementing an auto-update service for packages, reducing manual intervention and potential for errors. 5. Enhancing the website and API for better package management and user experience.

8/24/2020

This post details the investigation and resolution of slow HTTP/2 upload speeds, particularly for users with high bandwidth. The core issue was identified as insufficient receiver flow control in the HTTP/2 layer, specifically the fixed-size request body buffer in NGINX. The solution involved implementing an autotuning mechanism for the HTTP/2 request body buffer size, dynamically adjusting it based on the network's Bandwidth-Delay Product (BDP) to match or exceed HTTP/1.1 performance and achieve up to 3x improvement in production tests.

6/16/2020

Introduced Cache Analytics, a new tool providing deeper exploration capabilities into Cloudflare's caching performance. The tool allows users to see resources missing from cache, expired, or never eligible, filter data by hostname, URL, and content type, and toggle between views of requests and data transfer. It also provides breakdowns of cache status by content type and top N lists for various dimensions. Cache Analytics is available for Pro, Business, and Enterprise plans, with varying history access.

3/24/2020

Introduced a hybrid memory-SSD storage system that prioritizes placing unpopular assets in memory first before promoting them to SSDs. This strategy aims to reduce SSD wear and improve cache hit tail latency by minimizing writes to SSDs and leveraging memory for assets that are accessed infrequently or only once. The system is deployed on newer generation servers and a subset of assets, with careful consideration of memory footprint, competition with the page cache, and competition with process memory usage.

3/4/2020

Introduced dynamic padding to the Pwned Passwords API responses using Cloudflare Workers. This padding is generated on a per-request basis to obscure the exact size of API responses, mitigating traffic analysis attacks. The padding consists of randomly generated hash suffixes with a usage count of 0, and is applied to meet a minimum response size and add variable additional padding.

3/2/2020

This post details the author's experience using Bloom filters for large-scale data deduplication, addressing performance issues encountered with traditional tools like 'sort' and 'uniq'. It explains the principles of Bloom filters, their parameters (n, m, k, p), and the trade-offs involved. The author developed a tool 'mmuniq-bloom' and encountered performance bottlenecks due to random memory access and cache misses, even with an optimized Bloom filter implementation. The analysis highlights the significant cost of memory fetches and the impact of cache misses on performance, suggesting that reducing memory accesses is crucial for optimizing such data structures.

10/24/2019

This post details Cloudflare's defenses against three Cache Poisoning Denial of Service (CPDoS) vulnerabilities. It explains how Cloudflare mitigates the HTTP Header Method Override (HMO) attack by including specific method override headers in cache keys, and how the Oversized HTTP Headers (HHO) and HTTP Meta Characters attacks are mitigated by Cloudflare's default behavior of not caching 400 error responses. Specific recommendations are provided for Microsoft IIS users with request filtering enabled.

5/30/2019

This post details how Kali Linux integrated Cloudflare's CDN for distributing large ISO images and dynamic apt repositories. Key technical contributions include: implementing custom 'Expires' HTTP headers to disable expiration for static files, using 'Cache-Tag' headers to manage metadata caching, and integrating an API call to purge metadata from the CDN cache. The post also highlights Cloudflare's development of a feature to support caching of very large files, which was crucial for Kali's image distribution.

5/22/2019

This post details structural enhancements made to NGINX to improve HTTP/2 performance, specifically to increase the 'Potential' for prioritization algorithms. Key changes include: 1. HTTP/2 frame write queue reclamation: allowing unwritten frames from a partial write to be restored to per-stream queues for re-prioritization, rather than being held until the backlog clears. 2. HTTP/2 frame write event re-ordering: modifying the NGINX workflow to process frames from multiple upstream connections into per-stream queues before a single prioritization and write event, enabling frames from different streams to be in closer proximity for prioritization.

5/14/2019

Introduced a new feature for parallel streaming of progressive images by leveraging HTTP/2 prioritization. This technique dynamically re-prioritizes image data fragments: image headers are high priority for layout stability, minimum preview data is medium priority, and the remainder is low priority. This improves perceived image load time by up to 50% and allows pages to render sooner without additional data or JavaScript. The implementation is format-independent but most beneficial for JPEG and JPEG 2000. A custom `cf-priority-change` header is supported for experimentation with other resource types.

5/14/2019

This post introduces a new feature for HTTP/2 prioritization where Cloudflare servers take control of resource loading order, overriding browser defaults. This aims to optimize the delivery of critical resources like CSS, JavaScript, and images to reduce page load times, with observed improvements of up to 50%. The feature is available for paid plans and can be further customized using Cloudflare Workers.

4/17/2019

Introduced AMP Real URL, a feature that allows AMP pages served from caches (like Google's AMP Cache) to retain their original URL in the browser's address bar. This is achieved through cryptographic signing of the content provided to the AMP crawler, leveraging Web Packaging and browser support (initially Chrome on Android). This feature aims to improve brand protection, simplify analytics, increase screen space by removing the 'grey bar', potentially reduce bounce rates, and ensure content authenticity by cryptographically signing the content.

3/20/2019

This post introduces the CDN-Loop header, a new IETF draft standard developed in collaboration with other CDN providers (Fastly, Akamai) to address request loop protection. It details the problem of request loops, the shortcomings of previous solutions like the Via header (performance degradation due to legacy usage and gzip issues), and the ad-hoc methods used previously (CF-Connecting-IP, X-Forwarded-For). The post explains the syntax and usage of the CDN-Loop header and Cloudflare's implementation of it at the edge, replacing previous methods and allowing for more granular control over loop detection and prevention.

2/6/2019

This post emphasizes Cloudflare's overall speed and performance advantage across its services, including CDN, DNS, and Argo Smart Routing. It presents performance data from Cedexis and DNSPerf, and highlights case studies (Zendesk, OKCupid, U.S. Xpress, Bidu) demonstrating the business impact of improved web performance. It also lists key products that contribute to this performance: Argo, CDN, DNS, Load Balancing, and Web Optimizations.

1/25/2019

Introduced the Cloudflare Workers Cache API, based on the Service Workers Cache API, allowing programmatic control over Cloudflare's global caches. This API provides `put()`, `match()`, and `delete()` methods for managing cached responses keyed by requests. It enables custom caching behavior, such as TTL and cache tags, customer Vary logic, and caching of POST requests by transforming them into GET requests for caching purposes. The API can also be used as a general-purpose, ephemeral key-value store.

12/24/2018

Introduces a zero-config edge caching mechanism for HTML using HTTP headers (`x-HTML-Edge-Cache`). This allows origins to signal cacheability, purge requests (`purgeall`), and define bypass rules (e.g., `bypass-cookies=wp-|wordpress`) to edge caches. A Cloudflare Worker script and a WordPress plugin are provided as examples of implementing this protocol. The Worker utilizes a versioning scheme with Workers KV for global cache purging.

12/24/2018

Introduced a zero-configuration HTML edge caching mechanism using HTTP headers (`x-HTML-Edge-Cache`). This allows origins to signal cacheability, specify visitor rules (e.g., bypass for logged-in users), and trigger cache purges (`purgeall`). This reduces TTFB by serving HTML directly from the edge, eliminating origin server performance as a bottleneck for anonymous users. Demonstrated implementation with a WordPress plugin and Cloudflare Workers, utilizing Workers KV for cache versioning and global purging.

10/12/2018

This post details the optimization of HTTP/2 prioritization by tuning the Linux kernel's networking stack. It recommends enabling BBR congestion control and setting tcp_notsent_lowat to 16KB to minimize TCP send buffer buffering, thereby enabling servers to respond more nimbly to priority shifts and deliver high-priority resources without delay from lower-priority buffered data. The post explains the interaction between browser prioritization schemes, HTTP/1.x and HTTP/2 request handling, and the impact of TCP send buffers and Bufferbloat.

10/10/2018

This post details the implementation of a multi-tier object storage strategy for hosting Leaflet maps, leveraging Cloudflare Workers to serve tiles from Google Cloud Storage (for low latency, high-access tiles) and Backblaze B2 (for cost-effective, lower-access tiles). It also describes using Workers for path rewrites and redirects, and applying Cloudflare Argo for non-US/CA users to reduce latency to Backblaze B2. The post includes code examples for implementing the multi-tier fetching logic and conditional Argo routing, as well as a method for tracking subrequest origins (GCS vs. B2) via StatHat.

9/14/2018

Introduced the beta of the Cache API for Cloudflare Workers, enabling programmatic read and write access to Cloudflare's cache. This allows developers to implement custom cache semantics, cache POST requests that do not change origin state, and set Cache-Tag headers from within Workers.

8/28/2018

This post details the implementation of Edge Side Includes (ESI) using Cloudflare Workers to achieve high availability during a website migration. It describes how Workers can intercept requests, fetch fragments from both new and old backends, and stream the response, falling back to the origin if a new fragment fails. The worker code parses X-Fragments headers, initiates parallel fetches with timeouts, and streams the response body, replacing fragments with prefetched content or fallbacks. This enables a phased migration strategy by allowing parts of the page to be served by a new frontend while others remain on the legacy WordPress backend.

8/20/2018

This post details how Cloudflare mitigated a practical cache poisoning attack by modifying its cache key logic. The attack exploited origins that reflected data from HTTP headers (not part of the original cache key) into responses. Cloudflare's solution involves including specific 'interesting' headers (X-Forwarded-Host, X-Host, X-Forwarded-Scheme) in the cache key when they differ from the URL or Host header, preventing poisoned responses from being cached and served. The post also mentions proactive customer notification and blocking of malicious requests.

8/9/2018

This post details how Cloudflare Workers and custom cache key configurations were used to optimize the caching for the Pwned Passwords API, significantly improving its cache hit ratio. Specifically, it addresses two key issues: 1. Normalizing the case of the hash prefix in API requests to ensure consistent caching. 2. Removing the 'Origin' header from the cache key to prevent duplicate caching of the same asset from different origins. The post also touches upon the role of Argo in providing tiered caching.

7/31/2018

This post details modifications made to NGINX to address performance bottlenecks caused by blocking I/O operations (open() and read()) within the event loop. The solution involved moving these operations to thread pools, preventing them from blocking subsequent event handlers. Additionally, SO_REUSEPORT was enabled to improve the even distribution of requests across worker processes. These changes resulted in a significant improvement in p99 TTFB, estimated to save 54 years of wait time per day.

2/2/2018

Refactored Mirage and Rocket Loader JavaScript to use Rollup and ECMAScript modules, replacing the older AMD loader (CloudflareJS). This involved inlining parts of CFJS, switching from `document.write` for script insertion to direct script tags, and optimizing the loading sequence to benefit from browser preload scanning. The changes resulted in smaller JavaScript file sizes and improved page load performance.

1/19/2018

Introduced 'Cache Deception Armor' Page Rule to protect against Web Cache Deception attacks. This feature verifies that the URL's extension matches the returned Content-Type, preventing caching of mismatched responses. It includes exceptions for content types like `application/octet-stream` and common image/video format substitutions. This protection depends on Origin Cache Control and can be overridden by origin `Cache-Control` headers or Edge Cache TTL Page Rules.

12/14/2017

This post announces and details Cloudflare's full support for all HTTP Cache-Control response directives, including `public`, `max-age`, and `proxy-revalidate`. It explains how these directives allow origin servers to provide explicit instructions to the edge cache for managing content freshness and revalidation, using analogies to illustrate the concepts.

12/13/2017

This post details the debugging and resolution of an issue where cookie-based caching for anonymous Magento users caused the 'Add to Cart' functionality to fail on the first request. The root cause was identified as Cloudflare's default behavior of stripping `Set-Cookie` headers from cached responses, which prevented Magento from setting the necessary `frontend` cookie. The solution involved configuring Cloudflare's Page Rules to bypass the cache for requests containing specific cookies (`external_no_cache`, `PHPSESSID`, `adminhtml`) while still allowing caching for anonymous users. This enabled static caching of anonymous page views while ensuring dynamic interactions like adding items to the cart worked correctly.

10/6/2017

This post details how Cloudflare's CDN Interconnect program, with direct interconnections between Cloudflare and Google Cloud Platform data centers, offers advantages like higher performance, reduced congestion, and discounted egress pricing. It highlights the LUSH migration to GCP as a case study, showcasing significant bandwidth savings (75%) and a reduction in origin server requests (95%) due to Cloudflare's caching and threat filtering capabilities. The discussion also touches on cache hit rate dependency on website type and fine-grained control over caching and rate limiting.

4/25/2017

This post details best practices for leveraging Cloudflare's caching capabilities for ecommerce websites. It explains how to use Page Rules with 'Bypass Cache on Cookie' to serve cached content to new visitors while bypassing the cache for logged-in users or those with items in their basket. It also introduces a method using AJAX to populate dynamic content, allowing the majority of the page to be cached while specific elements are fetched dynamically. The post further explains how Railgun can accelerate dynamic HTML content that cannot be cached.

4/14/2017

This post details the Web Cache Deception attack and Cloudflare's two-phase caching logic (eligibility and disqualification) to defend against it. It outlines specific rules for cache eligibility based on request characteristics (file extensions, query strings, cookies) and disqualification based on response headers (Cache-Control, Expires, Set-Cookie). It also provides figures detailing 'Always Cacheable' and 'Sometimes Cacheable' file extensions.

12/12/2016

Introduced the 'Bypass Cache on Cookie' Page Rule option, allowing users to cache anonymous page views while excluding dynamic content personalized by cookies. This feature, available on the Business plan, works in conjunction with 'Cache Everything' Page Rules to reduce origin server load and improve load times. The setting supports wildcard and OR pipe operators, and allows customization of Edge Cache TTL. Cache purging via web interface, API, and platform integrations is also supported.

9/24/2016

This post details the server-side implementation of Automatic HTTPS Rewrites to address mixed content issues. It explains the limitations of browser-based solutions and the need for a performant server-side approach. The core technical challenge addressed is efficiently processing the large database of HTTPS Everywhere rulesets. The solution involves using Ragel to compile domain wildcards into a state machine, optimizing for left-side wildcards by reversing the matching order to reduce state explosion and improve compile times. The post also touches upon the need to rewrite HTTP sub-resources to HTTPS, ensuring availability and correct path upgrades.

6/14/2016

This post details the integration of Cloudflare's CDN and Universal SSL with GitHub Pages for static site hosting. It explains how to configure DNS records to point to GitHub Pages, use a CNAME file for custom domains, and leverage Cloudflare's 'Cache Everything' Page Rule to cache HTML directly from the CDN. It also covers enabling Universal SSL to provide HTTPS for custom domains, thereby enabling HTTP/2, and setting up Page Rules for enforcing HTTPS and redirecting non-www to www.

4/19/2016

Introduced API support for Page Rules, allowing programmatic creation and modification. Added 13 new settings to Page Rules, expanding configuration options and enabling future features to be automatically added. Implemented the ability to pause Page Rules for easier debugging and draft saving. Redesigned the Page Rules management panel to be mobile-friendly and responsive.

12/21/2015

This post delves into the internal workings of Go's `net/http` client, specifically its connection pooling and 'late binding' mechanism. It highlights how the client races to either establish a new connection or retrieve an idle one from a pool, aiming to minimize roundtrip latency. This concept of 'late binding' is directly compared to a similar mechanism used in Cloudflare's Railgun, demonstrating a shared engineering principle for optimizing connection management and performance across different systems.

10/23/2015

This post introduces Brotli as a new compression algorithm for dynamic web content, comparing its technical specifications (LZ77, Huffman coding, window sizes, match lengths) and performance against gzip (deflate). It details the underlying compression algorithms and presents experimental results of Brotli's effectiveness in reducing dynamic content size.

9/1/2015

This post details the performance improvements observed by a Cloudflare partner (Simple Helix) when implementing Cloudflare's CDN and Railgun™ for Magento hosting. It quantifies speed increases (100% with CDN, 143% with CDN + Railgun™) and bandwidth savings at the origin (up to 70% and 83.4%) during high-traffic events. It also touches upon the security benefits of the Web Application Firewall (WAF) in mitigating threats.

9/1/2015

Railgun v5 introduces significant improvements over previous versions, focusing on performance and resource efficiency. Key technical advancements include: substantial reduction in memory utilization and CPU requirements through extensive optimization based on real-world performance data; a completely replaced wire protocol that is lighter-weight, binary, faster, and uses less bandwidth; an additional layer of traditional non-delta compression applied after delta compression, yielding 10-15% greater compression; an automatic streaming mode for large downloads to bypass delta compression costs and ensure faster download times; improved origin web server connection management through connection pooling and better HTTP keep-alive utilization, reducing origin server load and latency; and enhanced cryptographic infrastructure with a switch to a new CA and mutual TLS for securing communication between Cloudflare and customer servers. The release also offers optimized partners improved compression rates and the ability to assign subdomains to a Railgun, with compatibility for RHEL and CentOS 7.

8/19/2015

Introduced Cache-Tags as a new method for cache purging. Cache-Tags are assigned to cached content via a Cache-Tag response header and stored as metadata. This allows for granular purges of specific sets of cached objects, taking effect globally in seconds. The feature is available for Enterprise plan websites and can be used via the Cloudflare dashboard or API.

7/7/2015

Introduced Query String Sort as an Enterprise-level feature. This feature sorts query strings in a URL into a deterministic order before checking cache or requesting from the origin, thereby increasing cache hit rates for resources where query string argument order varies but the resource is logically the same. This is particularly useful for API servers.

5/8/2015

This post announces the deprecation of Google's hosted PageSpeed Service and invites its customers to migrate to Cloudflare. It highlights Cloudflare's comparable performance features such as minification, image compression, and asynchronous loading, and emphasizes additional benefits like global network acceleration, Railgun, SPDY support, security, SSL, and DNS, all available across all plans, including the free tier. It also provides instructions for migrating from PageSpeed Service to Cloudflare.

3/30/2015

This post explores the use of preset DEFLATE dictionaries to improve compression ratios for common HTML content. It details the DEFLATE algorithm's LZ77 stage and Huffman encoding, explains the limitations of SDCH for multi-domain scenarios, and presents an experiment where a custom dictionary was built from scanned HTML pages to achieve better compression. The experiment showed a ~25% improvement in compression rate for a test set of pages.

7/15/2013

This post introduces and details Cloudflare's Railgun technology, highlighting its significant impact on e-commerce sites. It demonstrates how Railgun accelerates uncached HTML documents, reduces outbound bandwidth by compressing dynamic content (acting as a delta compression), and improves load times and bandwidth efficiency, particularly during traffic spikes. The post also discusses the potential for international expansion and future browser-level integration of this technology.

3/22/2013

Introduced the ability to reorder Page Rules by dragging and dropping them in the dashboard. This allows users to control the order of rule application, which is critical for scenarios where specific rules (e.g., excluding caching for admin pages) need to take precedence over more general rules (e.g., aggressive caching for all pages). Previously, reordering required deleting and re-adding rules.

3/13/2013

This post highlights the successful application of Cloudflare's 'Cache Everything' feature for dynamic HTML content on TheBayLights.org during a significant traffic surge. It demonstrates how enabling this feature reduced origin server load and resource utilization, effectively handling a large influx of traffic.

2/26/2013

This post announces the broader availability and ease of adoption for Cloudflare's Railgun technology. It details self-installation options (RPMs for various Linux/BSD, and an upcoming AMI for AWS) and highlights partnerships with over 30 leading hosting providers who will offer Railgun integration, often with a single click. This significantly expands the reach and accessibility of Railgun for dynamic content optimization.

2/1/2013

Introduced 'Edge cache expire TTL' as a new setting within Page Rules. This feature allows users to override any existing cache-related headers (e.g., Cache-Control, Expires) sent by the origin server. This enables Cloudflare's edge servers to cache content more aggressively, reducing the load on origin servers. The feature provides a dropdown menu to select the TTL duration, with different durations available based on Cloudflare plan types. It can be used in conjunction with 'Browser cache expire TTL' for differentiated caching strategies.

12/21/2012

This post introduces real-world performance data for Cloudflare's Railgun technology, demonstrating its effectiveness in speeding up the delivery of non-cached HTML pages. It details performance tests conducted with a hosting partner (Vexxhost) across 51 websites, measuring HTML delivery speedup, compression ratios, and overall page load time changes. The results show median improvements in HTML delivery speed (1.43x), TTFB (to 90% of original), and page load time (to 89% of original). The post also provides an estimation formula for predicting Railgun's impact based on initial HTML size and load time.

12/12/2012

This post details the partnership between Cloudflare and CDNJS, a project aiming to provide fast and reliable delivery of JavaScript, CSS, and image resources. Cloudflare's global network is used to serve CDNJS resources, resulting in significant performance improvements compared to Google and Microsoft's CDNs. The post highlights the benefits of using a centralized CDN for shared resources and browser caching, and notes CDNJS's expansion beyond JavaScript.

12/6/2012

This post highlights the challenge of delivering dynamically generated web content efficiently due to latency, even with compression like gzip. It introduces the concept of using shared dictionaries (SDCH and ESI) to achieve greater compression ratios by identifying and leveraging common, unchanging parts of web pages across users and requests. This would allow for smaller transmissions and fewer round trips, directly addressing the latency problem for dynamic content.

11/18/2012

This post highlights the adoption of the Go programming language for critical production systems at Cloudflare, including its use in the Railgun web optimizer. It signifies a strategic choice for high-performance, concurrent software development, directly contributing to the underlying technology that powers advanced caching and optimization features.

8/5/2012

Introduced Always Online v.2, which actively crawls customer pages to build a more robust cache, addressing the limitations of the previous version that relied on search engine crawler traffic. This active crawling mechanism ensures that cached content is more consistently available when origin servers go offline. The crawler's user agent is Mozilla/5.0 (compatible; CloudFlare-AlwaysOnline/1.0; +http://www.cloudflare.com/always-online). Crawl frequency varies by plan: every 9 days for free customers, every 3 days for Pro, and daily for Business/Enterprise. Future plans include user control over pinning and excluding pages.

7/14/2012

Introduced single file cache purge functionality, allowing users to invalidate specific URLs via the dashboard and API. This addresses the inefficiency of purging the entire cache when only a single file is updated, improving cache management granularity and enabling automated updates via developer systems.

7/3/2012

This post details the technical implementation of Cloudflare's Railgun software, specifically highlighting the choice and benefits of using the Go programming language. It explains how Go's concurrency primitives (goroutines and channels) and its object-oriented features (interfaces) were instrumental in building a performant and scalable solution for caching dynamic content. The post also emphasizes the ease of distribution due to Go's single executable output and the richness of its standard library.

7/3/2012

Introduced Railgun as a next-generation solution for caching dynamic HTML content. Railgun automatically identifies and caches static portions of HTML at the edge, while fetching dynamic portions from the origin without requiring code modifications. This is presented as an easier and more performant alternative to the complex Edge Side Includes (ESI) protocol.

7/2/2012

Introduced Railgun, a premium service for Cloudflare Business and Enterprise customers, designed to cache uncacheable content. Railgun works by recognizing that dynamically generated pages change slowly and uses a delta-compression technique, similar to video compression, to send only the differences between page versions. It consists of sender (in Cloudflare data centers) and listener (on customer networks) components that establish a permanent, TLS-secured TCP connection. This connection uses a binary multiplexing protocol to run multiple HTTP requests simultaneously. When a new request for a page is received, the sender compares it to the last seen version, sends the differences across the link, and reconstructs the page. This method significantly outperforms standard Gzip compression, achieving compression ratios as low as 0.29% for small page changes.

6/21/2012

This post introduces the fundamental concepts of bandwidth and latency, explaining how TCP's reliability mechanisms and the speed of light limit effective transfer speeds over long distances. It highlights Cloudflare's distributed network as a solution to reduce latency by bringing content closer to users.

5/23/2012

This post details the application of Cloudflare's Page Rules to cache HTML content for MoogMusic.com during a significant traffic spike caused by a Google doodle. By defining a Page Rule to 'Cache Everything' for static portions of the site, Cloudflare was able to serve approximately 92% of requests directly from its edge infrastructure, reducing origin VPS load and bandwidth by over 90%. This effectively allowed the origin VPS to handle the remaining dynamic content without being overwhelmed.

2/22/2012

Introduced Page Rules, a new feature allowing for per-page customization of Cloudflare's behavior. Specifically detailed how Page Rules can be used to enable advanced caching, including caching HTML content for pages identified by URL patterns. Explained the default conservative caching strategy and how Page Rules provide more granular control, overriding default settings and respecting or ignoring query parameters. Outlined limitations and variations, including cache refreshing and manual cache purging.

2/21/2012

Introduced URL forwarding functionality within the existing Page Rules interface. This allows users to define URL patterns and specify a target URL for redirection, supporting basic redirects and advanced scenarios using wildcard variables ($1, $2, etc.) to preserve parts of the original URL. This feature simplifies URL redirection tasks that previously required .htaccess configurations.

2/21/2012

Introduced 'Page Rules' to provide fine-grained control over Cloudflare features on a per-page basis. This allows users to define URL patterns and enable/disable specific features like Cloudflare Apps and performance optimizations (e.g., Rocket Loader, AutoMinify) for matching URLs. Rules are compiled into machine code and pushed to the edge for fast processing. Free accounts are limited to 3 rules per domain, with Pro accounts offering 20.

1/6/2012

This post introduces Cloudflare's core caching capabilities as a feature within its broader offering, distinguishing it from traditional CDNs. It highlights the ability to cache static content at the edge and its function as a caching reverse proxy that handles all requests to a website, enabling features beyond simple content delivery.

12/16/2011

This post details the application of bot-aware caching strategies, specifically differentiating between malicious bots and search engine crawlers by adjusting Time-To-Live (TTL) values. This approach aims to reduce the performance tax imposed by bots on dynamic content and improve overall application performance by serving search engine crawlers from a longer-lived cache.

10/26/2011

This post highlights the significant impact of Cloudflare's caching capabilities on a seasonal e-commerce website (The Pumpkin Lady). It details how Cloudflare saved approximately 1.54 Terabytes of bandwidth and 136,604,571 requests over 30 days during their peak season, enabling them to stay on a shared hosting environment and save hundreds of dollars in server expenses. The post emphasizes the value of Cloudflare's service in handling traffic increases and providing resource savings.

10/19/2011

This post introduces the implementation of end-to-end Keep Alives, a new optimization that maintains persistent TCP connections between Cloudflare's network and origin servers. This reduces latency by minimizing TCP overhead for each requested resource and lessens the load on origin servers. The change is expected to improve overall site snappiness by approximately 10% for sites whose origin servers support Keep Alive connections.

10/3/2011

Introduced Rocket Loader, a new feature that addresses the performance overhead of multiple HTTP requests for Javascript and CSS files. Instead of concatenating files, Rocket Loader streams individual files over a single HTTP connection to Cloudflare's network. This preserves file atomicity, avoids namespace clobbering bugs, allows for browser caching of individual files, and works with third-party scripts. It can be enabled manually by marking script tags with `cf-async="true"` or automatically for all resources, with an option to exclude specific scripts using `cf-async="false"`.

9/25/2011

This post quantifies the impact of Cloudflare's caching algorithms, reporting that users saved over half a petabyte of data transfer in the last 30 days. It also provides average savings figures of 60% bandwidth and 65% requests, and mentions ongoing refinement of caching algorithms.

8/4/2011

This post introduces a key architectural decision in Cloudflare's CDN offering: not rewriting static resource URLs to point to a third-party domain. This contrasts with traditional CDNs and is presented as a benefit for SEO by ensuring search engines attribute link credit to the origin domain. The post explains the technical implications of URL rewriting for SEO and highlights Cloudflare's transparent approach.

7/28/2011

This post introduces the concept of the 'Bieber Effect' moment, where a celebrity's social media mention can cause a massive spike in website traffic. It explains how Cloudflare's CDN can mitigate this by caching static content (like photos) and serving it from its distributed network, thereby reducing the load on origin servers and preventing meltdowns. It emphasizes the benefits of faster loading times, reduced bandwidth usage, and fewer requests.

7/13/2011

This post introduces Cloudflare's zero-configuration CDN caching for static content based on file extensions. It explains the benefits of faster page loading times and reduced bounce rates. It also provides guidance on integrating with existing CDNs and WordPress caching plugins, and details the use of Development Mode and cache purging for updating static content.

6/19/2011

This post introduces a significantly improved AutoMinify feature. The new implementation works in-line with the response stream, eliminating the need to cache content before minification and improving handling of dynamic HTML. It also boasts a much faster minification process, designed to operate efficiently at Cloudflare's scale, offering a measurable performance benefit of around 10% for text-based resources.

6/16/2011

This post details the migration of CDNJS, a community-moderated JavaScript library repository, to Cloudflare's global network. The migration addressed prohibitive costs associated with Amazon's CloudFront service and enabled SSL/HTTPS support, which was previously a limitation. Cloudflare's network provided significantly lower latency and improved caching capabilities, benefiting all users of CDNJS libraries. Latency improvements of approximately 1/3rd were observed compared to the previous setup, with CDNJS powered by Cloudflare showing an average latency of 14ms compared to 82ms for Google Libraries API.

6/10/2011

This post introduces Rocket Loader, a new feature that addresses script-blocking issues and improves asynchronous loading and bundling of third-party scripts. It enhances caching by utilizing Cloudflare's CDN and browser LocalStorage for intelligent script storage, aiming to double site performance even for sites using other CDNs, and is available on all plans, including the free one.

5/16/2011

This post introduces CNAME Flattening, a feature that overcomes DNS RFC limitations to allow zone apex domains (naked domains) to be CNAME records. This directly benefits users of cloud hosting providers like AWS EC2, Google App Engine, and Rackspace, enabling them to point their root domains to these services without requiring workarounds, thereby improving flexibility and performance.

5/3/2011

This post details research into Web Content Optimization (WCO) and introduces innovative techniques for preloading Javascript without execution. This work aims to further enhance web performance, especially on mobile devices, and will be deployed to all Cloudflare users.

2/3/2011

This post highlights the successful use of Cloudflare's 'Always Online' feature to keep www.groundhog.org available during a traffic spike and an origin server outage. It demonstrates the feature's ability to serve cached content when the origin is down, significantly reducing server load and preventing downtime. The post also mentions a 40% speed improvement for visitors worldwide due to Cloudflare's global network.

12/16/2010

This post introduces the fundamental concept of Cloudflare's network acting as a distributed reverse proxy and cache. It explains how caching resources (like images) at geographically distributed nodes closer to users improves website loading speed and reduces the load on origin servers. It also touches upon how dynamic content is handled by not caching it, ensuring freshness.

12/9/2010

This post describes the author's experience using Cloudflare's CDN and caching features to mitigate server load issues caused by malicious traffic and improve website performance. It highlights the ease of setup, the impact on page load times (73% faster), and bandwidth cost savings (38%). The author also mentions upgrading to a Pro account for advanced security functions and the website preloader.

12/7/2010

Introduced the 'Always Online' feature, which uses cached copies of static website content, built from search engine crawler patterns, to keep a site accessible when the origin server is down. This feature acts as a fallback for basic content, though dynamic functionality may still be affected.

12/2/2010

This post details the significant performance improvements experienced by a small business using Cloudflare's caching, including reduced page load times and bandwidth savings. It also introduces and praises 'Development Mode' as a crucial feature for developers to preview changes to cached content (CSS, JavaScript, images) without manual cache invalidation, highlighting its ease of use and automatic reversion after 3 hours.

11/12/2010

Introduced the 'Cache Purge' feature, allowing users to immediately invalidate all cached resources for a given domain. This feature was developed in response to user feedback and aims to address the frustration of waiting for cache expiration when making changes to static files. The post also clarifies the difference between Development Mode and Cache Purge, and outlines the scope and limitations of the new feature.