Cloudflare cache compatible
-
Is the plugin compatible with Cloudflare Cache everything [Template]? I cache all GET requests to /wp-json.
Thanks
-
Hi @leanca ,
I hope you are doing well.
Thanks for reaching out to the CF7 Apps Support Team. I’ll be happy to assist you.
The plugin relies on WordPress REST API endpoints
/wp-json. If these endpoints are cached by Cloudflare’s “Cache Everything” rule, it may return stale data or cause unexpected behavior.We recommend excluding the plugin’s REST API endpoints, or the full
/wp-json/*path, from Cloudflare caching.Could you please share a bit more detail about your query and use case? This will help us better understand the issue and guide you accordingly.
Thanks.
- When I open the page with the contact form, I see two identical requests:
GET https://example.com/wp-json/contact-form-7/v1/contact-forms/10/refill
{
"honeypot": {
"company-537": {
"random_hash": 70053892,
"field_name": "vtnvttmk4w0l"
}
}
}These requests are cached by Cloudflare.
2. I fill out the form and see the request:
POST https://example.com/wp-json/contact-form-7/v1/contact-forms/10/feedback
{
"contact_form_id": 10,
"status": "mail_sent",
"message": "Your message was sent successfully. Thanks.",
"posted_data_hash": "9de14d9bbc92856281227fd3a0398f4f",
"into": "#wpcf7-f10-p9-o1",
"invalid_fields": [],
"honeypot": {
"company-537": {
"random_hash": 22377308,
"field_name": "g87vvhrsqwfu"
}
}
}This request is not cached by Cloudflare.
3. Below I see another request:
GET https://example.com/wp-json/contact-form-7/v1/contact-forms/10/refill
{
"honeypot": {
"company-537": {
"random_hash": 70053892,
"field_name": "vtnvttmk4w0l"
}
}
}This request is cached by Cloudflare.
it may return stale data
Yes, as you can see above, the cached requests haven’t changed, and the information differs from the non-cached request. Could this be a problem? Emails arrive without errors.
What problems can be expected in the future?
Hi @leanca
Thank you for the detailed analysis and for sharing the request data.
You are correct that, based on your testing, form submissions are working properly and emails are being delivered successfully. The fact that the
/feedbackendpoint is not being cached explains why the submission process itself continues to function as expected.The concern is not that form submissions will fail, but that the Dynamic Honeypot protection may become less effective when the
/refillendpoint is cached.The purpose of the Dynamic Honeypot is to generate fresh and unpredictable values on a regular basis. When Cloudflare serves a cached
/refillresponse, the same honeypot values are reused instead of being regenerated. As you’ve observed, this does not prevent legitimate users from submitting forms, but it does reduce the randomness that the feature is designed to provide.The potential future impact is that the Dynamic Honeypot protection may become less effective over time if the same cached honeypot values continue to be reused. While legitimate form submissions will continue to work, the protection becomes more predictable and may be easier for automated bots to adapt to.
For this reason, we recommend excluding the Contact Form 7 REST API endpoints from Cloudflare caching so that fresh honeypot values can be generated as intended.
Thank you again for taking the time to investigate and share your findings.
After testing, it turned out that about 50% of forms were submitted successfully, and 50% weren’t.
"contact_form_id": 10,
"status": "spam",I decided to disable caching for JSON, but if the server load was high, I’d switch to an earlier version. I think I’ve had no problems with either submissions or spam for a long time with version 3.4.0.
Hi @leanca ,
I hope you’re doing well.
Thank you again for your detailed testing and feedback.
Based on your findings, we recommend excluding the Contact Form 7 REST API endpoints from Cloudflare caching so that fresh honeypot values can be generated correctly for each form submission. Cached JSON responses may cause stale honeypot values to be reused, which can result in legitimate submissions being marked as spam.
In addition, we have prepared a beta build that includes improvements related to the cache issue. This build also includes optimized transient handling, using a single transient instead of multiple transients.
You can download the beta version here:
Please install the updated build and test it on your site. Let us know if the issue still occurs after testing, or if you notice anything else unexpected.
Thanks again for helping us improve the plugin.
I think I’ve already lost a lot of clients who couldn’t contact me because the contact form wasn’t working, so I won’t risk it with the beta version.
Reducing the number of Transients is a good idea, because my Cron job only runs once a day, and during that time, several thousand Transients accumulate.
Where can I read more about what you’ve changed regarding the cache issue?
Hi @leanca ,
Thank you for your feedback.
We completely understand your concern about not wanting to test the beta version on a live site, especially when the contact form is important for receiving client enquiries.
Regarding the cache-related changes, these updates are currently included in the beta build and are still being tested. The main changes include optimized transient handling, using a single transient instead of multiple transients.
We have also made changes to the JSON response handling. Some values that were previously static in the JSON data are now generated dynamically, which should help improve compatibility with cached environments and reduce the chance of stale honeypot data being reused.
At the moment, there is no separate documentation page for these beta changes. Once the build is fully tested and released, we will include the details in the plugin changelog/release notes.
Thanks again for your detailed testing and feedback. It has been very helpful in improving the plugin’s compatibility with caching setups.
- When I open the page with the contact form, I see two identical requests:
You must be logged in to reply to this topic.
