Cloudflare Cache Inspector

WordPress plugin for checking Cloudflare cache response headers directly from the WordPress admin bar.

The plugin is intentionally passive: it does not run checks on every page load. A check runs only when a logged-in user asks for it.

Czech user guide: docs/uzivatelsky-navod.md.

Information

• Version: 1.0.0
• Author: Daniel Dočekal, https://365tipu.cz/
• Contact: daniel@justit.cz
• License: GPL-2.0-or-later
• Requires: WordPress 6.0+, PHP 7.4+

Cloudflare Cache Inspector is not an official Cloudflare plugin.

Development Note

This project was developed as a collaboration between Daniel Dočekal and OpenAI Codex. Daniel provided the problem, requirements, verification, and project decisions; Codex assisted with implementation, documentation, checks, and repository preparation.

Features

• Adds CF Cache to the WordPress admin bar.
• Opens a small panel without reloading the page.
• Runs two manual checks for the current page:
  • Test as logged-in - request with the current browser session cookies.
  • Test anonymously - request without cookies.
• Shows useful Cloudflare and HTTP response headers:
  • cf-cache-status
  • age
  • cf-ray
  • cache-control
  • expires
  • content-type
  • vary
  • location
  • HTTP status
• Optionally purges the current URL from Cloudflare cache.

Why Checks Are Manual

Automatic checks on every page load would add unnecessary requests and could distort the observed cache state. The plugin waits in the admin bar and checks only on demand.

How Checks Work

The plugin sends a browser HEAD request to the current URL:

• the logged-in check uses credentials: include,
• the anonymous check uses credentials: omit,
• the URL must stay on the same origin as the current page,
• the check-only part does not use a custom REST or AJAX endpoint.

The result shows headers from a new check request, not from the original HTML document that has already loaded in the browser.

Current URL Purge

The plugin can optionally call the Cloudflare API and purge the current URL from cache.

• Configuration is available directly in the CF Cache panel via the gear icon.
• Only administrators with manage_options can configure purge credentials.
• Users with edit_posts can purge the current URL by default.
• The Cloudflare API token never goes to the browser; it stays server-side in WordPress.
• The purge action accepts only the current same-origin URL and uses a WordPress nonce.

Zone ID

1. Open Cloudflare Dashboard.
2. Select the domain.
3. Stay on the Overview page.
4. Find Zone ID in the API section in the right sidebar.
5. Paste it into the plugin configuration.

Cloudflare API Token

Recommended token:

• type: custom token,
• permission: Zone / Cache Purge / Purge,
• zone resources: one specific zone, or multiple specific zones where you want to use this plugin,
• no DNS, Workers, Firewall, or account-wide permissions unless you deliberately need a broader token.

One API token can be reused across multiple WordPress sites if the corresponding Cloudflare zones are included. Each WordPress site still needs its own Zone ID.

Cloudflare purge API requires Zone ID in the endpoint URL even if the token is limited to one zone.

Security

The design is intentionally conservative:

• the plugin does not accept arbitrary URLs,
• it does not test third-party domains,
• purge calls only the Cloudflare purge API and only after an authorized user action,
• it stores only optional Zone ID and API token for purge,
• it does not expose a public endpoint,
• the admin bar item is visible only to logged-in users with read,
• common nonce/action query parameters such as _wpnonce, _wp_http_referer, action, and action2 are removed before probe and purge actions.

The last point matters mainly in WordPress admin screens. The plugin should not repeat URLs that represent one-time administrative actions.

Limitations

• Browser JavaScript cannot read the Set-Cookie response header.
• Some sites handle HEAD differently than GET.
• MISS can become HIT on a repeated test because the first request may have populated cache.
• In WordPress admin, sensitive action parameters may be stripped from the tested URL for safety.

Installation

1. Download the installable ZIP from GitHub Releases.
2. In WordPress admin, open Plugins.
3. Click Add New Plugin.
4. Click Upload Plugin.
5. Select the ZIP file.
6. Install and activate the plugin.
7. Click CF Cache in the WordPress admin bar.

Maintainer ZIP Build

bin/build-zip.sh is only a maintainer helper. WordPress does not need it to run the plugin.

From the repository root:

./bin/build-zip.sh

The installable ZIP is created in dist/.

cf-cache-status Values

• HIT - served from Cloudflare cache.
• MISS - fetched from origin; a later check may become HIT.
• DYNAMIC - not eligible for Cloudflare cache in the current configuration.
• BYPASS - Cloudflare bypassed cache, often because of cookies, authorization, or cache-control headers.
• EXPIRED - cached object expired and Cloudflare fetched a fresh response from origin.
• STALE - Cloudflare served stale cache, usually when origin was unavailable.
• REVALIDATED - Cloudflare validated the object with origin and served cache.
• UPDATING - Cloudflare served cache while refreshing it in the background.
• NONE/UNKNOWN - response did not go through the normal cache path, for example because of Workers, redirects, or WAF.