Introduction

Cloudflare's Cache Everything rule can speed up a site, but it becomes dangerous when it caches pages that depend on sessions, cookies, or per-user state. WordPress admin, login, preview, and cart-like flows are especially sensitive. The fix is to narrow caching so public pages stay cacheable while administrative and authenticated routes bypass the edge entirely.

Symptoms

  • WordPress admin shows stale pages, logout loops, or incorrect user state
  • Logging in appears to work, but the dashboard does not refresh correctly
  • Post previews or editor actions show cached content instead of current data
  • Users report seeing old admin notices or inconsistent backend behavior
  • The problem started after enabling a broad Cache Everything page rule or cache rule

Common Causes

  • Cache Everything applies to /wp-admin, /wp-login.php, preview URLs, or other session-sensitive paths
  • Edge caching ignores cookies that WordPress relies on for authenticated state
  • Cache bypass conditions are too broad, too narrow, or ordered incorrectly
  • A plugin or custom rule adds extra admin-like paths that are still being cached
  • Purging cache helps briefly, but the wrong routes are cached again immediately

Step-by-Step Fix

  1. Identify which WordPress paths are misbehaving and confirm whether Cloudflare cache headers show they are being served from cache.
  2. Review your active cache rules or page rules and locate any rule that forces caching for all URLs or large path patterns.
  3. Exclude sensitive WordPress routes such as /wp-admin, /wp-login.php, post previews, authenticated APIs, and other user-specific endpoints from edge caching.
  4. Check rule order so bypass rules for admin and login traffic are evaluated before any broader Cache Everything rule.
  5. If custom plugins or headless features add dynamic endpoints, include those paths in the bypass set as well.
  6. Purge the affected Cloudflare cache only after the corrected bypass rules are in place.
  7. Log in again, edit content, open previews, and verify the dashboard now reflects live state instead of cached responses.
  8. Keep full-page caching focused on anonymous front-end pages and avoid treating WordPress back-office traffic like static content.
  9. Revisit your cache strategy whenever plugins, ecommerce features, or logged-in user flows change so edge rules stay aligned with application behavior.