Cloudflare Vary in Cache Rules: Safe Content Negotiation Without Cache Explosion
Cloudflare's September 22, 2026 Vary support lets an origin declare which request headers can change a response while Cache Rules decide how those header values affect cached variants. Cloudflare offers three actions: normalize for bounded negotiation such as Accept, Accept-Language and Accept-Encoding; passthrough when the exact raw header value must select a representation; and bypass for personalized or high-cardinality variation. Vary: * always bypasses cache. The production risk is two-sided: ignoring meaningful variation can serve the wrong representation, while varying on unbounded values can fragment the cache and drive requests back to origin. Roll this out with a small supported representation set, consistent origin Vary headers, explicit treatment of Cookie/User-Agent-like dimensions, purge planning, and representative cache-hit tests before broad deployment.
A multilingual or multi-format endpoint serves the wrong cached representation to some clients
Cache hit ratio drops after adding Vary because raw request-header differences create too many variants
Personalized or User-Agent-dependent responses are accidentally considered cacheable
A Vary policy changed but old cache entries continue to exist until expiration or purge
Possible causes
The same URL can legitimately return different representations based on request headers such as Accept or Accept-Language
Raw request values can have much higher cardinality than the small set of representations an origin actually serves
Passthrough preserves byte-level differences in header values and can create separate variants even when the origin treats them as equivalent
Changing Vary configuration does not automatically purge existing cached content, and inconsistent origin Vary headers can let a response be cached without the isolation later responses require
HOW TO FIX IT
Work from the safest step to the harder repair.
Step 1. Confirm the current Cloudflare Vary documentation and inventory which cacheable routes intentionally return more than one representation for the same URL. Record the exact request headers that the origin uses to choose those representations.
Step 2. Keep the supported representation set bounded. For Accept and Accept-Language, list only media types or languages the origin truly serves rather than carrying every incoming preference into the cache key.
Step 3. Start with normalize for bounded negotiation where semantically equivalent request values should reuse the same cached response. Cloudflare specifically recommends normalization as the default starting point for negotiation headers.
Step 4. Use passthrough only when the exact raw header value must change the response. Remember that casing, whitespace, ordering and duplicate values can then produce separate cache variants and reduce reuse.
Step 5. Use bypass for personalized, high-cardinality or unpredictable headers such as Cookie or User-Agent unless you have a narrowly controlled design that proves those dimensions are safe to cache. Treat Vary: * as uncacheable because Cloudflare always bypasses it.
Step 6. Make origin behavior consistent across success, error and fallback responses. Every cacheable response whose representation depends on request fields should return the intended Vary header so an error or fallback cannot enter cache without the required isolation.
Step 7. Deploy the Cache Rule to a narrow path first. Test multiple request values that should normalize to the same representation and values that should remain distinct; verify response body/content-type/language as well as CF-Cache-Status after the cache is warm.
Step 8. Measure cache-hit ratio, origin request volume and variant behavior before expanding scope. A technically correct rule can still be operationally poor if it creates many one-off variants that evict reusable entries.
Step 9. Plan cache invalidation when changing the policy. Cloudflare says a Vary configuration change does not automatically purge existing content, so purge affected resources when stale variants would be unsafe or misleading.
Step 10. If configuring through the Rulesets API or Terraform, review the generated rule before apply. A phase-entrypoint PUT can replace the existing rule set, so preserve unrelated Cache Rules and use a scoped update workflow where appropriate.
Need the actual code? Go to GenesisCodeDoctor.com to search the Code Store or request code for the exact platform, error, and repair you are working on.
Keep authentication and authorization boundaries independent from cache configuration; never let a cache key become the only privacy boundary.
Test error, unauthenticated and fallback responses because an omitted Vary header on one cacheable response can defeat representation isolation.
Keep a rollback copy of the previous Cache Rule and record any purge performed during rollout.
STOP AND GET HELP WHEN
Do not turn a repair into a larger outage.
Do not cache personalized responses merely to improve hit ratio when Cookie, Authorization or another user-specific input changes the body.
Do not use passthrough for unbounded request headers without measuring cardinality and origin/cache impact.
Do not assume changing the Vary rule removes old variants; purge or let them expire according to a deliberate rollout plan.
Do not treat a high CF-Cache-Status hit rate as proof of correctness unless the returned representation is also verified for each tested request class.
HOW GENESIS HANDLES IT
Diagnose the exact failure before choosing a repair.
Genesis separates the visible symptom from the underlying technical cause. Run the supported diagnostic first, review the evidence, and then use a matching repair only when the failure is actually verified.
Is Cloudflare Vary in Cache Rules available on the Free plan?
Yes. Cloudflare says Vary in Cache Rules is available on Free, Pro, Business and Enterprise plans.
Should I use normalize or passthrough for Accept-Language?
Use normalize when many client language-preference strings map to a small supported language set. Use passthrough when distinctions in the exact header value must remain meaningful to the origin and cache.
What happens with Vary: *?
Cloudflare always bypasses cache for Vary: * because any aspect of the request may affect the selected response.
Does changing a Vary configuration purge old cached variants?
No. Cloudflare says configuration changes do not automatically purge existing content. Old entries can remain until they expire or are purged, so include invalidation in the rollout plan when needed.
Once you know the platform and the verified problem, search the Genesis Code Doctor Code Store for a matching package. If the exact integration or repair is not there, use Request a Code and describe the platform, official documentation, desired behavior, and sanitized error—never send your secret key.
Start with a free diagnostic. If Genesis verifies a problem and a compatible treatment exists, continue to the matching Code Store product or repair path. If you cannot find the exact code you need, request it at GenesisCodeDoctor.com rather than forcing a generic snippet into the wrong platform.
GENESISCODE DOCTOR AI