OCMLABS/MODULE-CLOUDFLARE · SYSTEM SETTINGS
Configure the connection, zone, edge cache, purging, analytics and real IP handling in Stores > Configuration
Module settings live at Stores > Configuration > OCMLabs > Cloudflare (section ocmlabs_cloudflare). Scope is per group: connection and purging are global, the zone and edge cache settings are per website so each website can map to its own zone. Nothing is store-view scoped.
General
Default scope, except where noted.
| Field | Default | Description |
|---|---|---|
| Enable Cloudflare Integration | No | Kill switch for the whole module. Off means no edge headers, no real IP handling, no purges and no module cron work. |
| API Token | empty | Encrypted at rest. Needs Zone:Read, Zone:Cache Purge, Zone:Settings:Read, Zone:Settings:Edit, Zone:Cache Rules:Edit and Analytics:Read. Can be overridden at website scope to use a different Cloudflare account for that website. |
| Account ID | empty | Optional. Detected from the API token when left blank. Website scope allowed. |
| Debug Logging | No | Writes every Cloudflare API call to var/. The token is redacted. |
| Test Connection | button | Verifies the token and lists the zones it can see. |
Zone
Website scope.
| Field | Default | Description |
|---|---|---|
| Zone ID | empty | The Cloudflare zone that serves this website. |
| Detect Zone | button | Looks the zone up from the website’s base URL hostnames. Only shown at website scope. |
| Storefront Hosts | empty | Optional, one host per line. Overrides the hosts derived from the website’s base URLs. Used in cache rule expressions and by the live health probes. |
| Storefront Origin | empty | Optional origin address used by the “Origin sends edge cache headers” health check, which fetches a page directly from your server rather than through Cloudflare. Accepts a host, host:port, an IP or a URL. TLS certificate verification is skipped for this fetch, because an origin certificate is rarely valid for the public host. |
Edge Cache
Website scope.
| Field | Default | Description |
|---|---|---|
| Enable Edge Caching of HTML | No | When No, every storefront response carries Cache-Control: private, no-store, so a zone with a “Cache Everything” rule cannot cache HTML by accident. When Yes, pages Magento’s full page cache treats as public get public, max-age=0, s-maxage=<ttl>. |
| Edge TTL (seconds) | empty | How long Cloudflare keeps a page. Blank inherits the full page cache TTL (system/). |
| Bypass Paths | see below | One path prefix per line. Requests under these paths are never cached at the edge, and the “Bypass protected paths” cache rule is built from this list. {admin} is replaced with your real admin frontName. |
| Vary Handling | Bypass | What happens to visitors carrying the X-Magento-Vary cookie (a non-default store view, currency or customer group). Bypass the edge cache for varied requests works on every plan: those visitors are served by Magento’s full page cache. Vary on cache key (Enterprise only) adds the cookie to the cache key so each variant is cached separately. |
| Cache Query Strings | Yes | When No, any request with a query string skips the edge cache, and a “Bypass query strings” cache rule is added. |
The default Bypass Paths list:
/checkout/customer/sales/wishlist/paypal/rest/graphql{admin}/downloadable/newsletter/subscriber/review/product/post/catalogsearch/advanced/result/contactAdd the callback paths of your payment and shipping extensions to this list.
Purging
Default scope.
| Field | Default | Description |
|---|---|---|
| Purge Mode | By cache tag | By cache tag (recommended) purges exactly the tags Magento invalidated. By URL resolves product, category and CMS page tags to URLs, for setups where something between Magento and Cloudflare strips the Cache-Tag header. Purge everything purges the whole zone on every invalidation. |
| Purge Asynchronously | Yes | Queue purges through the ocmlabsCloudflarePurge consumer so saving a product is not slowed by an API round trip. With No, the purge runs inside the admin save that triggered it. |
| Purge Everything on Full Page Cache Clean | Yes | Flushing or refreshing the full page cache in the admin, or bin/, also purges the zone. |
| Max URLs per Tag | 500 | In URL mode, a tag that resolves to more URLs than this purges everything instead. |
Analytics
Default scope.
| Field | Default | Description |
|---|---|---|
| Enable Analytics | Yes | Shows the Analytics tab on the dashboard and lets the warm-up cron fetch data. |
| Analytics Cache TTL (seconds) | 900 | How long fetched analytics are cached in the ocmlabs_ cache type before the next GraphQL call. |
Real IP
Default scope.
| Field | Default | Description |
|---|---|---|
| Trust CF-Connecting-IP | Yes | Use the CF-Connecting-IP header as the visitor IP for requests whose TCP peer is a Cloudflare address. Requests from any other peer keep REMOTE_, so the header cannot be spoofed by hitting the origin directly. See Real Visitor IP. |
Configuration paths
For bin/magento config:set and env.php overrides, every field sits under ocmlabs_cloudflare/<group>/<field>:
ocmlabs_cloudflare/general/enabledocmlabs_cloudflare/general/api_tokenocmlabs_cloudflare/general/account_idocmlabs_cloudflare/general/debug_loggingocmlabs_cloudflare/zone/zone_idocmlabs_cloudflare/zone/storefront_hostsocmlabs_cloudflare/zone/storefront_originocmlabs_cloudflare/edge_cache/edge_cache_enabledocmlabs_cloudflare/edge_cache/edge_ttlocmlabs_cloudflare/edge_cache/bypass_pathsocmlabs_cloudflare/edge_cache/vary_handling (bypass | cache_key)ocmlabs_cloudflare/edge_cache/cache_query_stringsocmlabs_cloudflare/purging/purge_mode (tag | url | everything)ocmlabs_cloudflare/purging/purge_asyncocmlabs_cloudflare/purging/purge_on_fpc_cleanocmlabs_cloudflare/purging/max_urls_per_tagocmlabs_cloudflare/analytics/analytics_enabledocmlabs_cloudflare/analytics/analytics_cache_ttlocmlabs_cloudflare/real_ip/trust_cf_connecting_ipSet the token with --encrypt:
bin/magento config:set --encrypt ocmlabs_cloudflare/general/api_token "<token>"bin/magento config:set --scope=websites --scope-code=base ocmlabs_cloudflare/zone/zone_id "<zone id>"