Guide · Cloudflare edge and browser policy
Cloudflare Cache Rules and Origin Cache Control
A reader-facing path for separating origin headers, Cloudflare's edge rule, browser TTL, cache-key identity, and purge scope.
Start with the five questions
| Question | Read | Do not infer |
|---|---|---|
| Who may store it? | Classify private versus safely shared before adding a public Cache Rule. | A custom key does not make personalized bytes safe. |
| What controls the edge? | Inspect OCC plus the matching Edge Cache TTL mode: respect, bypass by default, or override. | A viewer Cache-Control header is not the hidden Edge TTL. |
| Which browser lifetime? | Read Browser TTL and the delivered viewer header separately from edge storage. | An edge purge does not clear a visitor's browser or service-worker copy. |
| Which object is this? | Record the default/custom cache-key dimensions, including query/header/cookie choices. | A URL purge without key inputs may miss a custom-key variant. |
| What should be removed? | Select URL, tag, prefix, hostname, or everything by required blast radius, then verify. | HTTP 200 from the purge API is not a deletion receipt. |
Open the dated report: it contains the one-page precedence/purge matrix, two decision paths, matched CloudFront crosswalk, authorized-only verification template, source links, retrieval window, and unresolved documentation-only limits.
Two safe starting paths
Private or sensitive
Keep the path out of public caching rules, preserve restrictive origin policy, and audit OCC, matching rules, Workers/Cache API, and downstream copies. A purge is not a privacy repair.
Public, versioned asset
Use a new fingerprinted URL for changed bytes, keep the key dimensions intentional, record browser and edge lifetimes separately, and use a tag or narrow purge only for the release scope required.
Evidence boundary
The report explains what current Cloudflare and HTTP documentation says a named configuration should do. It does not say what any real zone did: this run had no account, zone, authorized endpoint, response headers, POP evidence, or purge authorization.