Commerce Safety

Commerce Safety

The failure mode this exists to prevent: a shared cache serves one customer's cart, checkout or account page to another customer. It is rare, it is catastrophic, and it is entirely preventable.

GT Performance ships adapters for FluentCart, Easy Digital Downloads and WooCommerce. All three are on by default and only activate when the corresponding plugin is active.

What an adapter contributes

Each adapter declares the state that must never be shared, and the plugin compiles all active adapters into both the origin bypass policy and the Cloudflare rule:

• Dynamic paths — cart, checkout, account, order-received, downloads
• Session cookies — the cookie prefixes that indicate a customer with state
• Query parameters — add-to-cart, wc-ajax, fluent-cart and equivalents
• AJAX routes — endpoints that must always reach PHP

Because the compiled policy feeds the edge rule too, Cloudflare bypasses the same paths your origin does. The two cannot drift apart by hand-editing one of them.

Safety Lab

Non-destructive verification that the policy actually holds. It runs real requests against your own site and reports what happened. It never places an order, never mutates data, and never writes to the cache.

Checks include:

• Cart, checkout and account URLs return a bypass rather than a cached copy
• A request carrying a session cookie is not served a shared entry
• Commerce query parameters bypass as configured
• The compiled Cloudflare expression covers the same paths as the origin policy
• Adapter-declared routes are all represented in the live policy

Results are stored per run so you can compare after a plugin update. Run it from Safety Lab, or:

wp gt-performance safety

Policy drift

The compiled commerce policy is hashed. When an adapter's declarations change — you activate WooCommerce, or a commerce plugin updates and moves its endpoints — the hash changes and the plugin recompiles the bypass policy and flags the Cloudflare rule as needing a sync.

This matters because commerce plugins do move their routes between versions, and a cache rule written for the old paths would silently start caching the new ones.

If you use a commerce plugin that has no adapter

Add its cart, checkout and account paths to bypass paths, and its session cookie prefix to bypass cookies, under Exceptions. Then run Safety Lab and confirm each URL reports a bypass.

Do not rely on the unknown_query rule alone. It bypasses on unrecognised query parameters, but a cart page reached at a clean URL with a session cookie needs the cookie rule to be right.

Private Islands and commerce

If your only dynamic element is a cart count in the header, you do not have to bypass every page. See Private Islands.

Related

Page Cache · Private Islands · Cloudflare · WP-CLI