Guide template: follow one Cloudflare request

A complete Orange Book Guide pattern from outcome and prerequisites to checkpoints.

GUIDEBEGINNER15 minutesLast verified: 2026-08-26

Outcome

You can place DNS, the Cloudflare edge, a Worker, and the origin on one request path and know which layer to inspect first.

Prerequisites

Know that a domain name points visitors to a site; no coding is required.
A test hostname proxied through Cloudflare makes the checks easier to follow.

Build the mental model first

When a DNS record is proxied, the request reaches the Cloudflare edge. The edge can terminate TLS, apply security policy, evaluate cache behavior, and run a Worker when a route matches.

Cloudflare request-path architecture diagram — A primary request moves from the client through DNS, the edge, and an optional Worker to the origin. Numbers map to the notes below.Open original

01
Client
A browser or application starts the request.
02
DNS
Resolves the hostname and determines proxying.
03
Edge
Handles TLS, security policy, and cache decisions.
04
Worker
Optionally rewrites, authorizes, or composes.
05
Origin
Produces content when the edge needs it.

Verify one layer at a time

Confirm DNS and proxy status

Check the hostname, record type, and value in the Dashboard. The orange cloud controls proxying; it does not promise a cache result.

Inspect response headers

curl -I https://example.com/assets/app.css

Read CF-Cache-Status. A first MISS followed by a HIT usually means the object was eligible and then filled into cache.

Narrow the failing layer

Start with the record for DNS failures, the certificate path for TLS failures, and the cache-status runbook for DYNAMIC or BYPASS.

Checkpoint

You should now be able to draw five nodes and explain why “proxied” and “cache hit” are different statements.

AI workbenchHuman reviewed

Keep an AI investigation layered

The prompt asks for evidence and prevents a jump to an unsupported conclusion.

I am investigating a request that passes through Cloudflare. For DNS, TLS/edge security, cache, Worker, and origin, list:
1. Evidence you need from me;
2. Read-only verification commands;
3. The result that would rule out that layer.
Do not guess my Dashboard settings and do not suggest changing production rules yet.

Pitfalls and next step

Proxying does not mean HTML, JSON, or responses with cookies are automatically cached.
A Worker can be part of the path, but every site does not need one.
Continue with the first edge application learning path.