info

Affiliate Disclosure: This article contains benchmarked tools that may compensate us. We only recommend hardware and software tested in our lab environments for maximum LCP and INP efficiency.

WordPress Cache Configuration Errors: Post-Mortem Report

Incident: 2,400 Duplicate Orders in 6 Hours Root cause: a Cloudflare “Cache Everything” page rule overrode WooCommerce no-store headers on /checkout/ and /order-received/. The CDN cached the order confirmation page and served it to multiple users. Fix: Cloudflare Cache Rules (bypass for WooCommerce) Lessons Learned Never use “Cache Everything” without explicit WooCommerce exclusions. Set Cache-Control:…

calendar_today
folder

Incident: 2,400 Duplicate Orders in 6 Hours

Root cause: a Cloudflare “Cache Everything” page rule overrode WooCommerce no-store headers on /checkout/ and /order-received/. The CDN cached the order confirmation page and served it to multiple users.

Fix: Cloudflare Cache Rules (bypass for WooCommerce)

(http.request.uri.path contains "/cart") or
(http.request.uri.path contains "/checkout") or
(http.request.uri.path contains "/my-account") or
(http.cookie contains "woocommerce_cart") or
(http.cookie contains "wordpress_logged_in")

Lessons Learned

  • Never use “Cache Everything” without explicit WooCommerce exclusions.
  • Set Cache-Control: no-store explicitly in checkout hooks — do not rely only on CDN rules.
  • Monitor for unexpected cache hits on authenticated pages via Cloudflare Analytics.
  • Test cache configuration on a staging environment that mirrors production exactly.