Skip to main content

Cloudflare WAF + LSCache Security

Cloudflare and LSCache solve different problems: Cloudflare blocks bad traffic at the edge, while LSCache serves cached HTML quickly at the origin. This page shows how to configure both so security rules don't break caching, and caching doesn't leak personalized content.

Responsibilities by Layer

LayerOwnsNotes
Cloudflare edgeWAF, bot controls, rate limits, IP reputationStop bad traffic before it reaches PHP
Origin web serverfile access rules, optional ModSecurity, firewallCheap filtering close to the kernel/web server
LSCache (WordPress)page cache + exclusions + ESI (if used)Ensure cache is safe for WordPress session behavior

Cloudflare Baseline (WordPress-Safe)

Recommended starting point:

  • Enable managed WAF rules.
  • Protect login attempts (rate limit or challenge on POSTs to wp-login.php).
  • Block /xmlrpc.php if you do not use it.
  • Avoid broad blocks of /wp-json/.

Example WAF expressions (Cloudflare expression language):

block-xmlrpc-expression.txt
http.request.uri.path eq "/xmlrpc.php"
login-post-expression.txt
http.request.uri.path eq "/wp-login.php" and http.request.method eq "POST"
caution

Do not cache or block /wp-json/ broadly. Gutenberg and many plugins rely on REST endpoints.

LSCache Exclusions (Minimum)

Make sure LSCache does not cache transactional or authenticated pages.

Exclude pages/paths:

  • /wp-admin/
  • /wp-login.php
  • /cart/, /checkout/, /my-account/

Bypass caching when these cookies are present:

  • wordpress_logged_in_
  • wp_woocommerce_session_
  • woocommerce_cart_hash

If you use ESI for WooCommerce, keep fragments small (mini-cart count, account widget) and verify no leakage across sessions.

Verification (Headers)

Public page should show cache hits after warm:

curl-public-page-cache-signals.sh
curl -I https://example.com/ | grep -iE 'cf-cache-status|x-litespeed-cache'

Checkout should bypass:

curl-checkout-bypass.sh
curl -I https://example.com/checkout/ | grep -iE 'cf-cache-status|x-litespeed-cache'

Common Failure Modes

SymptomLikely CauseFix
Users see cached content when logged inCookie bypass missingAdd bypass for wordpress_logged_in_ and Woo session cookies
Cart/checkout breaksTransactional routes cachedExclude cart/checkout/account and retest checkout end-to-end
Legit users blockedOver-aggressive WAF/rate limitsStart with challenge/rate limit, review events, tune thresholds
Double challenges at loginMultiple layers limiting loginPick one layer for login protections (edge preferred)

What's Next