FAQs
No, you do not need create Edge Cache TTL page rules. When the WordPress plugin is installed, APO automatically caches content for 30 days and invalidates on change within 30 seconds. However, because APO now supports cache-related page rules, make sure existing page rules do not affect the resources served by APO.
No. APO ignores Origin Cache Control for caching on the Edge, but APO serves original Origin Cache Control to the client.
The browser cache control headers may be missing with APO if you set your Browser Cache TTL to Respect Existing Headers. For example:
curl --silent --verbose --output /dev/null https://example.com/ --header 'Accept: text/html' 2>&1 | grep cache-control< cache-control: max-age=86400, stale-while-revalidate=86400, stale-if-error=86400No, the stale-if-error directive is not needed because the feature is built into APO.
When I check the posts and homepage cache status, the response header shows cf-cache-status: BYPASS. Is APO working?
When Chrome DevTools is open, Chrome sends Cache-Control: no-cache by default. You can uncheck the Disable cache (while DevTools is open) setting and see that cf-cache-status: HIT and cf-apo-via: cache headers will be returned.
When I check cf-cache-status via cURL, MISS and DYNAMIC are always returned. In my browser, I see HIT but other tools return DYNAMIC. Is this expected behavior?
Yes, this is expected behavior because the requests must contain accept: "text/html".
Yes, Google Fonts are also optimized when APO is activated. You can confirm the optimization by checking the font URLs. For example, the URL will change from https://fonts.gstatic.com/s/... to https://example.com/fonts.gstatic.com/s/... when the site loads. For proxied fonts, the cf-apo-via:proxy header is returned.
For more information on query parameters, see Query parameters and cached responses.
APO will skip URL font transformation when the content-security-policy response header is present but missing the values described below.
To fix the problem, the content-security-policy header value must allow for unsafe-inline on either the style-src or default-src directive. For example, Content-Security-Policy: style-src unsafe-inline;.
The header must allow for self on either the font-src or default-src directive. For example, Content-Security-Policy: font-src self;.
Was this helpful?
- Resources
- API
- New to Cloudflare?
- Products
- Sponsorships
- Open Source
- Support
- Help Center
- System Status
- Compliance
- GDPR
- Company
- cloudflare.com
- Our team
- Careers
- 2025 Cloudflare, Inc.
- Privacy Policy
- Terms of Use
- Report Security Issues
- Trademark