Orange Collar Media
Orange Collar Media
 DOCS
OCMLABS/MODULE-CLOUDFLARE · CHANGELOG

Cloudflare module changelog

  • Magento
  • Adobe Commerce
  • Hyvä

All notable changes to OCMLabs Cloudflare are listed here. This module follows Semantic Versioning.

1.0.1 - 2026-10-28

Fixed

  • Test Connection and the token_valid health check rejected account-owned API tokens (Manage Account > Account API Tokens, prefix cfat_) with “Invalid API Token”. Cloudflare’s user/tokens/verify endpoint only accepts user-owned tokens; the module now verifies at accounts/{id}/tokens/verify when an Account ID is configured, and otherwise falls back to it when the user endpoint returns 401. Every other call the module makes is zone-scoped and already worked with both kinds.

1.0.0 - 2026-10-22

First public release.

Added

  • Edge caching of storefront HTML. Pages Magento’s full page cache treats as public get Cache-Control: public, max-age=0, s-maxage=<ttl>, CDN-Cache-Control and a Cache-Tag header built from Magento’s cache tags. Everything else gets private, no-store. Off by default.
  • Session cookies are stripped from cacheable responses, as Magento’s Kernel and VCL do. Responses that set X-Magento-Vary are never cached.
  • Purging by cache tag, URL, prefix or everything, triggered by Magento’s own cache invalidation. A tag purge sends exactly the tags Magento cleaned (never the store or website tags every page carries). Queued through the ocmlabsCloudflarePurge consumer by default, with a per-account rate limiter that follows Cloudflare’s plan limits (one token per 100-item request) and honours Retry-After; a rate limit part-way re-queues only what is left.
  • Purge log in System > Cloudflare > Purge Log.
  • Recommended cache rules, previewed as a diff and applied without touching rules the merchant wrote. Custom cache keys on Enterprise zones; the vary bypass rule on other plans.
  • Admin dashboard with Overview (zone, plan, development mode, quick purge), Analytics and Health tabs.
  • 25 health checks in five groups (connection, zone settings, cache rules, Magento, live probes), run hourly from cron and on demand.
  • Real visitor IP from CF-Connecting-IP, honoured only when the peer is a Cloudflare IP. Cloudflare’s IP ranges are refreshed daily with a bundled fallback.
  • Cloudflare-aware Varnish VCL export, from the CLI or the Health tab. In Varnish mode the module leaves Magento’s headers and cookies to Varnish and keeps the edge marker and Cache-Tag for the VCL, which makes the edge decision and skips vary-context requests.
  • CLI: ocmlabs:cloudflare:purge, ocmlabs:cloudflare:status, ocmlabs:cloudflare:dev-mode, ocmlabs:cloudflare:health, ocmlabs:cloudflare:rules:apply, ocmlabs:cloudflare:vcl:export.
  • Multi-website support: each website can map to its own zone and its own API token. Websites sharing a zone each own their own [OCMLabs] ... (<website code>) cache rules.
  • The Enable Cloudflare Integration switch is a kill switch: off means no edge headers, no real IP handling and no module cron work.

Upgrade notes

  • After installing or upgrading, run bin/magento setup:di:compile (or clear generated/) and a full bin/magento cache:clean. Generated proxies and the merged RequireJS config are stale otherwise.
  • In production mode, run bin/magento setup:static-content:deploy.

Known limitations

  • Behind Varnish the edge caches default-context pages only; Vary Handling Cache key is not supported in Varnish mode.
  • The exported Varnish VCL is not syntax-checked by the module. Run varnishd -C -f <file> before loading it.
  • If Cloudflare renames a GraphQL Analytics field, the affected panel fails on its own; the rest of the Analytics tab still loads.
  • In URL purge mode, tags that do not map to a product, category or CMS page URL (for example cat_c_p_*) purge everything.

Requirements

  • Magento Open Source or Adobe Commerce 2.4.4 or later
  • PHP 8.1 or later
  • A Cloudflare zone proxying the storefront
  • Cron running, so the purge queue consumer runs

See also

In this module