Cloudflare and WooCommerce: caching and bot rules that break checkout

Caching the wrong pages

“Cache everything” rules are great for product pages and dangerous for cart, checkout and my-account. Bypass the cache for those paths and whenever WooCommerce cart or session cookies are present — the Cloudflare cache documentation covers rules and bypass.

The symptoms are the same as a misconfigured full page cache on Magento: empty carts, someone else’s cart, expired nonces.

Bot protection

Bot fight modes and challenges can block payment provider webhooks, the Store API and monitoring tools. Customers on VPNs or corporate networks may get challenges on the checkout itself.

Allow payment providers’ callbacks through, and avoid challenges on checkout paths unless you are under a card testing attack.

Edge optimisation

Features that minify, defer or rewrite JavaScript at the edge can break payment scripts the same way optimisation plugins do. Exclude checkout pages or disable those features and let the site handle optimisation.

After every CDN change, test a full purchase in a private window. A scheduled external check shows a CDN challenge as UNKNOWN and a broken script as a failure — two different problems, clearly separated.

Check your own store now with the free WooCommerce checkout checker: it walks the checkout in a real browser and shows the step where it stops.