Caching can make a website faster, but a rule that is safe for a brochure page may expose stale or personalised content on a store. The objective is not to cache everything; it is to cache predictable content while protecting dynamic customer journeys.
Map static and dynamic routes
List pages that are the same for everyone and routes that depend on session, account, cart, location, currency or role. Product pages may be mostly static, while cart and account pages are not.
Include API endpoints, payment callbacks, webhooks and admin routes. A visual page list alone is not enough.
Define full-page cache exclusions
Exclude cart, checkout, account, login, password reset and personalised pricing. Also exclude requests with session or cart cookies where the platform requires it.
Test guest, logged-in, wholesale and administrator roles separately. A cache leak may affect only one role and remain hidden during basic testing.
Use browser and object caching for the right data
Long browser caching is appropriate for versioned CSS, JavaScript, fonts and images. Object caching can reduce repeated database work but should not store incorrect application state.
Version assets or change filenames when they are updated so long cache lifetimes do not keep old code.
Plan cache purging
Publishing content, changing prices, updating stock or deploying code should purge only affected content when possible. Purging the entire site repeatedly creates traffic spikes and slow first requests.
Document who can purge caches and which layers exist: application, server, CDN, browser and third-party proxy.
Protect payment and API traffic
Do not cache payment callbacks, order APIs, webhooks or requests that contain authentication. Preserve required headers and verify the original client IP where security rules depend on it.
A CDN firewall can block legitimate callbacks if rules are copied without testing. Allow trusted services narrowly rather than disabling protection globally.
Validate after every major rule change
Complete real test journeys: browse, search, add to cart, update quantity, select shipping, pay, receive email, log in and log out. Repeat on mobile and in an incognito session.
Check response headers to confirm whether each page was cached or bypassed. Visual inspection alone cannot confirm the active cache path.
Monitor stale content and edge errors
Track 4xx/5xx changes, cache-hit ratio, origin response time and customer reports of wrong stock or account content. Keep a documented bypass procedure for incidents.
A good cache configuration is observable and reversible. Performance improvements should never remove the ability to diagnose what a customer actually received.
