Full page cache and checkout: when Varnish serves the wrong page
Full page cache — built in or through Varnish — is the single biggest speed win on a Magento store. It is also a quiet source of checkout bugs, because a cached page looks perfectly healthy to anyone who checks it from outside.
What should never be cached
Cart, checkout and customer account pages are personal. Magento marks them as uncacheable and fills the personal parts — mini cart, customer name, form keys — through private content loaded after the page. When that split works, everyone gets a fast page and their own cart.
Trouble starts when a custom block or a third-party module marks a checkout-related page as cacheable, or when a Varnish configuration is edited by hand and stops passing the right cookies. Then one customer’s state, or an expired form key, can be served to many.
How it shows up
The symptoms are strange and intermittent: “Invalid Form Key” on add to cart, a mini cart that shows an empty basket, prices that do not match what the cart charges, a checkout that loads but will not advance. Refreshing sometimes fixes it, which makes it easy to dismiss.
A request that only checks for a 200 response will never see this. The page loads, fast, from cache. Only a real flow — add a product, open the cart, move through checkout — shows that the state behind the page is wrong.
What to do about it
Keep the Varnish VCL generated from Magento and version it with the code, so it changes only through a deploy. After any module install, check that checkout, cart and customer pages still come back with no-cache headers.
Run the checkout flow from outside on a schedule, as a new visitor each time. A fresh session is exactly what a cache mistake punishes, so it is the best way to catch one before customers report it. Related: CDN caching rules on WooCommerce and Redis sessions and lost carts.
Check your own store now with the free Magento checkout test: it walks the checkout in a real browser, Luma or Hyvä, and shows the step where it stops.
Common questions
Should the Magento checkout be cached?
No. Cart, checkout and customer account pages, and the customer-data sections they load, must never come from the full page cache.
How do I know Varnish is serving the wrong page?
Customers see another cart, a stale mini cart, wrong prices after a change, or a checkout that loses the session. Response headers such as X-Magento-Cache-Debug or Age show whether a page came from cache.
How do I fix it?
Check the VCL against the version Magento generates for your release, keep cacheable="false" blocks off cacheable pages, and purge after configuration changes.