Software Engineer Intern

Cloudflare Cache Response Rules: closing the post-origin performance gap. New Cloudflare rules let you fix cache-breaking headers like Set-Cookie after origin response, no code changes required. Performance boost. Cloudflare cache removes cookie header from origin. By Andres SEO Expert. Key takeaways. * Cache Response Rules run after origin reply but before cache write, fixing headers that break caching. * Strip Set-Cookie, ETag, Last-Modified; modify Cache-Control; manage cache tags without origin changes. * Available on all Cloudflare plans; complements existing Cache Rules for end-to-end cache control. Cloudflare's Cache Response Rules: the missing half of CDN caching control. Cloudflare has released Cache Response Rules, a new rule type that operates in the critical moment after an origin server responds but before Cloudflare writes the response to cache. This addresses a long-standing pain point: cache-breaking headers like Set-Cookie or misguided Cache-Control directives that originate from the server and undermine cache efficiency. With Cache Response Rules, organizations can strip, modify, or add headers and directives at this exact juncture, requiring zero changes to origin infrastructure. Table of contents. The core breakdown: how Cache Response Rules work. Cache Response Rules fill a specific timing gap. Traditional Cache Rules operate during the request phase, before Cloudflare contacts the origin. They decide whether to cache an object and under what key, using only request-time information. But many cache eligibility problems only become visible after the origin responds. The post-origin problem. When an origin returns a response, headers like Set-Cookie, incorrect Cache-Control directives, or overly aggressive ETags can make an otherwise cacheable asset ineligible for caching. This forces every subsequent request to bypass the cache and hit the origin, degrading performance and increasing costs. Cache Response Rules intercept these responses before Cloudflare's cache evaluates them, allowing teams to: * Strip headers like Set-Cookie, ETag, and Last-Modified that block caching. * Modify Cache-Control directives including max-age, s-maxage, stale-while-revalidate, and no-cache, with an option to apply changes only to Cloudflare's view (cloudflare_only). * Manage cache tags by setting, adding, or removing tags used for purge-by-tag operations, including translating tags from other CDN formats. Complementary, not replacement. According to Cloudflare's official announcement, Cache Response Rules do not replace Cache Rules. They add a response-phase layer that answers a different question: given the origin's response, should Andres SEO Expert LLC adjust how Andres SEO Expert LLC cache it? Cache Rules decide whether, what, and how to cache on the request. Cache Response Rules get the final word on the how and whether after seeing the response. When both rule types conflict, the response rule wins. Real-World use cases. Common scenarios include stripping Set-Cookie from static assets like JS, CSS, and fonts; overriding no-cache directives on known-static paths; and translating Surrogate-Keys headers from another CDN into Cloudflare's Cache-Tag format during migrations. Cloudflare provides example expressions and actions in their documentation. Strategic analysis: closing the gap in CDN performance. The introduction of Cache Response Rules represents a significant step toward true end-to-end cache control. Previously, teams had three workarounds for response-time cache issues: modify origin code, deploy a Cloudflare Worker to rewrite responses, or accept a lower cache hit ratio. Each option carried costs in engineering time, added latency, or ongoing operational expense. Cache Response Rules provide a fourth, far more efficient path. The official Cloudflare glossary defines fundamental cache concepts like cache hit, cache miss, and TTL, underscoring the platform's focus on caching performance. But the glossary also notes that Enterprise customers can adjust proxy read timeout using cache rules, hinting at deeper configuration possibilities for advanced users. Cache Response Rules extend this configurability to the response phase, giving all plan levels more granular control. Third-party ecosystem tools are already embracing the new capabilities. For instance, the Cache Tags for Cloudflare WordPress plugin, developed by Per Soderlind, demonstrates practical use of the Cache-Tag header and purge-by-tag API. The plugin emits Cache-Tag headers for posts and taxonomy terms, and performs batched purges respecting Cloudflare's 30-tag-per-call limit. According to the plugin documentation, the Cache-Tag header and purge-by-tag functionality are available on all Cloudflare plans, with only purge API rate limits scaling by plan tier. This shows that Cache Response Rules' cache tag management action can directly integrate with such existing workflows, making CDN migrations smoother and tag-based purging more accessible. For performance professionals, the implications are clear. Cache Response Rules eliminate the need to chase misconfigured headers through origin code, reducing time-to-fix from weeks (in large teams with separate origin and CDN management) to minutes. They also enable hybrid cache strategies where Cloudflare can hold assets longer than the browser, decoupling TTLs without complex origin setup. This is particularly valuable for sites with dynamic-static hybrid content, like ecommerce platforms where session cookies mistakenly attach to product images. However, teams must apply these rules judiciously. Stripping Set-Cookie from responses that genuinely require it can break functionality. Cloudflare advises scoping rules by path or extension, and being honest about what content is truly static. Conclusion: A new standard for Cache Control. Cache Response Rules close a critical gap in CDN caching architecture. By allowing modifications at the precise moment when response headers are about to affect cache eligibility, Cloudflare empowers organizations to reclaim lost cache efficiency without touching origin infrastructure. This innovation reinforces the principle that caching decisions should be as flexible and layered as the applications they serve. For teams looking to maximize CDN performance, integrating Cache Response Rules into your caching strategy is a logical next step. Andres SEO Expert helps businesses implement advanced caching configurations and performance engineering. Explore its WordPress Speed Engineering and Managed WordPress Cloud Hosting services to optimize your site's delivery. For a tailored caching audit, connect with Andres or learn more about Andres SEO Expert. Frequently asked questions. What are Cloudflare Cache Response Rules? How do Cache Response Rules differ from traditional Cache Rules? When should I use Cache Response Rules? Can Cache Response Rules replace Cloudflare Workers for cache control? What are the risks of using Cache Response Rules? How do Cache Response Rules work with cache tags? How do Cache Response Rules improve performance? July 23, 2026

Does your website have a firewall? The 2026 guide for Singapore SMEs (including two free ones). Most SME websites have no real firewall - and in 2026 two of the best options are free. Cloudflare, Wordfence, Sucuri and AWS WAF compared, with the setup that fits your site. Ask a business owner if their office has a lock on the door and they'll look at you funny. Ask if their website has a firewall and you'll usually get a pause, then: "...I think the hosting company handles that?" Usually, it doesn't - at least not the kind that matters. And since Oasis Web Asia has written before about how website breaches actually happen (automated attacks scanning every site on the internet, no matter how small), this is the natural follow-up: the single most effective piece of protection you can add, what it costs in 2026, and which one fits your situation. Spoiler: for many SMEs the right answer is free. What a web application firewall actually does. A web application firewall (WAF) is a bouncer standing between the internet and your website. Every request to your site - every visitor, every bot, every attack - passes it first. Legitimate traffic walks through; anything matching known attack patterns gets turned away at the door: SQL injection attempts, brute-force login attacks, DDoS floods, and exploit payloads hunting for known holes in plugins and themes. The key phrase is before it reaches your server. Without a WAF, every attack gets to try its luck against your actual site, and your security depends entirely on nothing ever being out of date. With one, the overwhelming majority of junk never arrives at all. It's the difference between a bouncer at the door and hoping every window in the building is locked. One distinction worth knowing, because it explains the recommendations below: DNS-level (cloud) firewalls filter traffic out in the provider's network before it ever touches your server - strongest protection, and they usually speed your site up too. Application-level (plugin) firewalls run inside your website itself - the attack reaches your server but gets inspected there. Cloud is the stronger front line; a plugin is a valuable second layer. The picks for 2026. Cloudflare - the default choice, and the free tier is genuinely good. Cloudflare is consistently rated the best fit for personal sites up to mid-sized businesses, and its free plan provides excellent protection for most sites - DNS-level filtering, DDoS protection among the best available, bot blocking, and a global CDN that makes your site faster as a side effect. The Pro plan at US$20/month adds the fuller managed WAF ruleset and is widely called the best value for growing businesses - flat-rate, so it doesn't climb with your traffic. If you do one thing after reading this post, putting your site behind Cloudflare is it. Wordfence - the WordPress specialist, as a second layer. If your site runs WordPress (statistically, it probably does), Wordfence is the leading security plugin: an application-level firewall plus malware scanning and login protection, with a capable free version and a paid tier around US$79-99/year for real-time rule updates. Its limitation is the flip side of its design - being a plugin, it inspects attacks after they reach your server. Which is why the widely recommended 2026 setup for WordPress sites is Cloudflare free + Wordfence free together: cloud filtering in front, WordPress-aware inspection behind. Two layers, zero dollars. Sucuri - the all-in-one, and the one to call if you're already infected. Sucuri's cloud WAF (roughly US$10-42/month, or ~US$199/year for the full platform) works with any CMS - WordPress, Joomla, Drupal, custom builds - and bundles virtual patching, hardening, and security monitoring into one service. Its standout is what no one else on this list does as well: professional malware cleanup. If your site is already compromised, Sucuri's remediation service scrubs the infection and gets you off Google's blocklists. Best pick if you want one vendor handling everything, or if you're reading this because something's already gone wrong. AWS WAF - for custom applications on Amazon's cloud. If your business runs a custom web application on AWS (rather than a CMS website), AWS WAF integrates natively - pay-as-you-go from roughly US$15/month, scaling with rules and traffic. It's more of a developer's tool than a set-and-forget product, so it belongs in the conversation with whoever builds and maintains your application. (Enterprise-grade options like Imperva exist at US$400+/month - genuinely powerful, and genuinely overkill for a typical SME.) The quick decision. * Any website, any budget: put it behind Cloudflare free today. * WordPress: Cloudflare free + Wordfence free - the two-layer standard. * Want one vendor for everything, or already hacked: Sucuri. * Custom app on AWS: AWS WAF, configured by your developer. * Growing, traffic-heavy, or e-commerce: Cloudflare Pro at US$20/month is the best-value upgrade on this list. Two things a firewall won't do, so nobody oversells you. First, a WAF is a shield, not a substitute - it blocks attacks against vulnerabilities, but the vulnerabilities are still there. Updates, strong passwords with MFA, backups, and sensible access control (all covered in its website security checklist) still matter; the RedDoorz breach Oasis Web Asia recently wrote about, for instance, involved a leaked access key that no firewall would have caught. Second, setup quality matters: a WAF in "logging only" mode, or with your server still directly reachable around it, is security theatre. Ten minutes of correct configuration is the difference between protected and decorated. And a note for PDPA-minded owners: under Singapore law you're required to make reasonable security arrangements for the personal data you hold. In 2026, with capable firewalls available literally free, "we didn't have one" is an increasingly hard position to defend - to the regulator or to your customers. Where oasis web asia comes in. Every site Oasis Web Asia build ships behind a properly configured firewall as standard - typically Cloudflare, layered and locked down correctly, with the rest of the security basics (updates, access control, backups, PDPA-aligned data handling) built in rather than bolted on. If you have an existing site and honestly don't know what's protecting it, Oasis Web Asia can check in minutes and set it right - usually without changing anything your visitors see. It's part of the same evidence-first web development Singapore SMEs come to Oasis Web Asia for: unglamorous foundations, done properly, so the phone call from a stranger never comes. If you got to the end of this post and realised your answer to "does your website have a firewall?" is still "...I think so?", that's exactly the conversation Oasis Web Asia like to have. Start a conversation | - get a free consultation with its Singapore-based team. Related blogs. Website data breaches aren't just a big-company problem - and in Singapore the PDPA puts you on a 3-day clock with real... When Oasis Web Asia think about complying with PDPA and Web Security while building web and mobile application, one feature known as Audit Logs... At this moment, it should be clear that security for your website or mobile app platform is clearly an important component of...

WordPress security alert: Cloudflare deploys WAF rules for critical RCE and SQLi. Cloudflare deploys emergency WAF measures against two critical WordPress flaws. Learn the details and how to safeguard your site. Code bracket shield with padlock for WordPress security. By Andres SEO Expert. Key takeaways. * Cloudflare deployed emergency WAF rules targeting CVE-2026-60137 (SQL injection) and CVE-2026-63030 (unauthenticated RCE) affecting WordPress 6.8+. * WordPress released patches in versions 7.0.2, 6.9.5, 6.8.6, and 7.1 Beta 2. * The WAF rules block exploit attempts but patching is essential; automatic updates are rolling out for eligible sites. Cloudflare rushes WAF rules to Block critical WordPress RCE and SQLi flaws. In an emergency response earlier today, Cloudflare deployed dedicated Web Application Firewall (WAF) rules to protect WordPress sites from two severe vulnerabilities: CVE-2026-60137 (SQL injection) and CVE-2026-63030 (unauthenticated remote code execution). The flaws affect WordPress versions 6.8 and later, with the RCE impacting 6.9+. WordPress has released patches in versions 7.0.2, 6.9.5, 6.8.6, and 7.1 Beta 2, and is forcing automatic updates for affected sites. Table of contents. Inside the vulnerabilities and Cloudflare's response. The SQL injection flaw, present from version 6.8, allows crafted input to alter database queries. The more critical RCE, found in version 6.9 onwards, enables unauthenticated attackers to execute arbitrary code via the REST API batch endpoint when no persistent object cache is used. Cloudflare's engineering team confirmed that the two issues are related. Cloudflare deployed two rules at 17:03 UTC on July 17, 2026. The first rule targets SQL injection attempts (CVE-2026-60137), while the second blocks requests aiming to exploit the RCE vector (CVE-2026-63030). Both rules are set to 'Block' by default and are available to all Cloudflare customers, including free plan users, as long as traffic is proxied through the WAF. Cloudflare's announcement confirms the rules are part of its Managed Ruleset and Free Ruleset. Customers on Pro, Business, or Enterprise plans are advised to ensure Managed Rules are enabled. Free plan users receive automatic protection. Cloudflare stresses that these WAF rules are a temporary mitigation and not a substitute for patching. Strategic implications for the WordPress ecosystem. The rapid coordination between Cloudflare and WordPress' security team highlights the escalating threat landscape for the platform, which powers over 43% of the web. The forced automatic update policy used by WordPress for such high-severity issues sets a precedent for proactive defense. However, site owners should verify their patch status, as not all hosts support automatic updates. This incident arrives amidst a flurry of WordPress developments. Recent reports also cover the new resizable editor, performance boosts in WordPress Studio, and the rise of agentic commerce. While these features drive innovation, security remains the bedrock of trust. The Cloudflare WAF rules provide a crucial safety net while the ecosystem updates. According to analysis from Andres SEO Expert, the dual nature of the vulnerabilities - SQLi and RCE - indicates a systemic risk in the REST API and cache handling. Organizations running WordPress should review their object cache configurations and ensure they are on the latest patched versions. The WAF rules, while effective, should be considered a temporary measure; the only permanent fix is updating WordPress core. Are you prepared for the next wave of WordPress threats? Cloudflare's swift action demonstrates the value of a robust web application firewall in a defense-in-depth strategy. However, the fundamental responsibility lies with site administrators to maintain updated software. As WordPress continues to evolve with AI and commerce integrations, the attack surface will only grow. Staying ahead in the rapidly shifting landscape of WordPress requires precision. To future-proof your digital strategy and scale effortlessly, you need a foundation built on precision. Optimize your site with advanced speed engineering, secure your infrastructure in high-performance hosting environments, and streamline your entire workflow through autonomous AI pipelines. If you are ready to elevate your systems, Connect with Andres at Andres SEO Expert to build your ultimate architecture. Frequently asked questions. What are the two critical WordPress vulnerabilities addressed by Cloudflare? Which WordPress versions are patched for these flaws? What did Cloudflare do in response to the vulnerabilities? Are the Cloudflare WAF rules a permanent fix? How can I ensure my site is protected if I use Cloudflare? What strategic implications does this incident have for WordPress site owners? Why is the RCE vulnerability more critical than the SQLi one? July 17, 2026