Troubleshooting: why CF-Cache-Status is not HIT

Distinguish DYNAMIC, BYPASS, and MISS from response headers, then locate cache problems with read-only steps.

TROUBLESHOOTING · READ ONLY FIRSTSymptom → evidence → fixVerified: 2026-08-26

Symptom

You expect a resource to be cached, but the response repeatedly does not contain CF-Cache-Status: HIT. Do not purge the whole site or change production rules yet.

Step one: preserve raw evidence

curl -sS -D - -o /dev/null https://example.com/assets/app.css

Record the status code, CF-Cache-Status, Cache-Control, Set-Cookie, Age, and request URL. Request the same URL twice without changing configuration between attempts.

Step two: branch on the status

DYNAMIC

Cloudflare decided the response was not cache eligible before a lookup. Check the resource type, Cache Rules, and Development Mode first.

BYPASS

The request reached cache evaluation, but the origin response or configuration prevented caching. Inspect Cache-Control, Set-Cookie, and bypass rules.

MISS

The response was eligible, but the object was absent for this request. Repeated MISS from the same client justifies checking fill, eviction, or the cache key.

NONE/UNKNOWN

A Worker, WAF action, or redirect may have generated a response outside cache. Identify the component that produced it.

Do not read Age alone

Age appears with some cache states, but an origin can also send its own Age. Establish the path with CF-Cache-Status, then use Age as supporting evidence.

Step three: make the smallest fix

Evidence	Smallest first action	Do not start with
`DYNAMIC`	Confirm the URL should be cached and the Cache Rule matches	Purge Everything
`BYPASS` + `Set-Cookie`	Confirm whether the cookie is necessary and inspect the origin	Deleting every cookie
`BYPASS` + `private/no-store`	Confirm privacy and freshness with the data owner	Forcing private content into cache
Repeated `MISS`	Hold URL, client, and cache-key conditions constant	Changing several rules together

Verify the fix

Repeat the exact read-only request and compare complete headers. The fix is complete only when the intended public resource has the expected stable status without crossing a privacy or authorization boundary.

AI workbenchHuman reviewed

Ask AI to classify header evidence

Below are complete response headers from two consecutive curl requests to one URL. Using only Cloudflare's documented CF-Cache-Status semantics:
1. Classify the path as DYNAMIC, BYPASS, repeated MISS, or other;
2. Cite exact headers I supplied as evidence;
3. Give the next read-only check;
4. State which conclusions still lack evidence.
Do not suggest Purge Everything and do not assume my Cache Rules.

Prevent recurrence

Keep one repeatable header check for important resources.
Change one Cache Rule condition at a time and record before-and-after evidence.
Do not force private, authenticated, or health-check responses into cache just to obtain a HIT.

Before changing rules, use the Cache Rules recipe that preserves sign-in and APIs, then return to the request-path architecture.