probeo

How to fix CF-Cache-Status Header?

cf_cache_status_header_present global

The issue

The CF-Cache-Status header tells anyone who inspects a response that it came through Cloudflare, and whether Cloudflare served it from cache. That is a small disclosure. Probeo treats cf-cache-status as a standard header and never flags it, because the same fact is public anyway.

The cause is Cloudflare itself, which adds the header to responses it proxies. A hostname proxied by Cloudflare also resolves to Cloudflare’s published IP ranges, so hiding the header doesn’t hide the CDN.

Scope

The header is on every response that passes through Cloudflare, pages and assets alike. It says nothing about the origin server behind Cloudflare.

How to check you have it

  • By hand: run curl -sI https://example.com/ and look for cf-cache-status in the output. Values such as HIT, MISS, EXPIRED, BYPASS and DYNAMIC describe the cache state.
  • In the browser: open DevTools, select the document in the Network tab, and read its response headers.

The fix

In most cases, leave the header in place.

Cloudflare doesn’t let Response Header Transform Rules add, modify or remove headers whose names start with cf-, so there is no supported setting that strips it. If a policy requires less disclosure, spend the effort on headers that name software and versions, such as X-Powered-By or a versioned Server, which probeo does flag.

Done when: the headers that disclose software and versions are gone, and the check above shows only Cloudflare’s own headers.

Do not

  • Do not build client-side logic on the value of CF-Cache-Status.
  • Do not treat removing it as hiding the CDN; DNS already shows it.
  • Do not spend effort here while versioned Server or X-Powered-By headers remain.

FAQ

What does CF-Cache-Status reveal?

That the response passed through Cloudflare, and whether Cloudflare served it from cache, fetched it from the origin or bypassed the cache.

Can the header be removed without affecting caching behavior?

The header is informational, and caching doesn’t depend on it. The obstacle is that Cloudflare’s Transform Rules can’t remove headers that start with cf-.

Are there other Cloudflare headers that should be removed?

CF-Ray discloses the same fact, and probeo treats it as standard too. A Server: cloudflare header names the CDN without a version, so probeo doesn’t flag it either.

Does removing the header improve security?

Very little. A proxied hostname resolves to Cloudflare’s published IP ranges, so the CDN is visible without any header.

Can the header be removed using Cloudflare Transform Rules?

No. Cloudflare’s documentation says Response Header Transform Rules can’t add, modify or remove headers whose names start with cf- or x-cf-.

Should staging environments also remove this header?

There’s no more reason to on staging than in production. If a staging site is public, the headers that name software and versions matter more.

Which product detects this

Probeo checks this on every page of your site as part of Site Clarity. This page explains one instance; the product tells you every page that has it.