Title: Cloudflare cache compatible
Last modified: June 16, 2026

---

# Cloudflare cache compatible

 *  Resolved [leanca](https://wordpress.org/support/users/leanca/)
 * (@leanca)
 * [3 months, 1 week ago](https://wordpress.org/support/topic/cloudflare-cache-compatible/)
 * Is the plugin compatible with Cloudflare Cache everything [Template]? I cache
   all GET requests to /wp-json.
 * Thanks

Viewing 7 replies - 1 through 7 (of 7 total)

 *  Plugin Support [Muhammad Usama Azad](https://wordpress.org/support/users/usamaazad99/)
 * (@usamaazad99)
 * [3 months, 1 week ago](https://wordpress.org/support/topic/cloudflare-cache-compatible/#post-18940588)
 * Hi [@leanca](https://wordpress.org/support/users/leanca/) ,
 * I hope you are doing well.
 * Thanks for reaching out to the **CF7 Apps Support Team**. I’ll be happy to assist
   you.
 * The plugin relies on WordPress REST API endpoints `/wp-json`. If these endpoints
   are cached by Cloudflare’s “Cache Everything” rule, it may return stale data 
   or cause unexpected behavior.
 * We recommend excluding the plugin’s REST API endpoints, or the full `/wp-json/*`
   path, from Cloudflare caching.
 * Could you please share a bit more detail about your query and use case? This 
   will help us better understand the issue and guide you accordingly.
 * Thanks.
 *  Thread Starter [leanca](https://wordpress.org/support/users/leanca/)
 * (@leanca)
 * [3 months, 1 week ago](https://wordpress.org/support/topic/cloudflare-cache-compatible/#post-18940712)
    1. When I open the page with the contact form, I see two identical requests:
       GET
       [https://example.com/wp-json/contact-form-7/v1/contact-forms/10/refill](https://example.com/wp-json/contact-form-7/v1/contact-forms/10/refill)
 *     ```wp-block-code
       {	"honeypot": {		"company-537": {			"random_hash": 70053892,			"field_name": "vtnvttmk4w0l"		}	}}
       ```
   
 * These requests are cached by Cloudflare.
 * 2. I fill out the form and see the request:
 * POST [https://example.com/wp-json/contact-form-7/v1/contact-forms/10/feedback](https://example.com/wp-json/contact-form-7/v1/contact-forms/10/feedback)
 *     ```wp-block-code
       {	"contact_form_id": 10,	"status": "mail_sent",	"message": "Your message was sent successfully. Thanks.",	"posted_data_hash": "9de14d9bbc92856281227fd3a0398f4f",	"into": "#wpcf7-f10-p9-o1",	"invalid_fields": [],	"honeypot": {		"company-537": {			"random_hash": 22377308,			"field_name": "g87vvhrsqwfu"		}	}}
       ```
   
 * This request is not cached by Cloudflare.
 * 3. Below I see another request:
 * GET [https://example.com/wp-json/contact-form-7/v1/contact-forms/10/refill](https://example.com/wp-json/contact-form-7/v1/contact-forms/10/refill)
 *     ```wp-block-code
       {	"honeypot": {		"company-537": {			"random_hash": 70053892,			"field_name": "vtnvttmk4w0l"		}	}}
       ```
   
 * This request is cached by Cloudflare.
 * > it may return stale data
 * Yes, as you can see above, the cached requests haven’t changed, and the information
   differs from the non-cached request. Could this be a problem? Emails arrive without
   errors.
 * What problems can be expected in the future?
 *  Plugin Support [Muhammad Usama Azad](https://wordpress.org/support/users/usamaazad99/)
 * (@usamaazad99)
 * [3 months, 1 week ago](https://wordpress.org/support/topic/cloudflare-cache-compatible/#post-18941234)
 * Hi [@leanca](https://wordpress.org/support/users/leanca/)
 * Thank you for the detailed analysis and for sharing the request data.
 * You are correct that, based on your testing, form submissions are working properly
   and emails are being delivered successfully. The fact that the `/feedback` endpoint
   is not being cached explains why the submission process itself continues to function
   as expected.
 * The concern is not that form submissions will fail, but that the Dynamic Honeypot
   protection may become less effective when the `/refill` endpoint is cached.
 * The purpose of the Dynamic Honeypot is to generate fresh and unpredictable values
   on a regular basis. When Cloudflare serves a cached `/refill` response, the same
   honeypot values are reused instead of being regenerated. As you’ve observed, 
   this does not prevent legitimate users from submitting forms, but it does reduce
   the randomness that the feature is designed to provide.
 * The potential future impact is that the Dynamic Honeypot protection may become
   less effective over time if the same cached honeypot values continue to be reused.
   While legitimate form submissions will continue to work, the protection becomes
   more predictable and may be easier for automated bots to adapt to.
 * For this reason, we recommend excluding the Contact Form 7 REST API endpoints
   from Cloudflare caching so that fresh honeypot values can be generated as intended.
 * Thank you again for taking the time to investigate and share your findings.
 *  Thread Starter [leanca](https://wordpress.org/support/users/leanca/)
 * (@leanca)
 * [3 months ago](https://wordpress.org/support/topic/cloudflare-cache-compatible/#post-18946240)
 * After testing, it turned out that about 50% of forms were submitted successfully,
   and 50% weren’t.
 *     ```wp-block-code
       "contact_form_id": 10,	"status": "spam",
       ```
   
 * I decided to disable caching for JSON, but if the server load was high, I’d switch
   to an earlier version. I think I’ve had no problems with either submissions or
   spam for a long time with version 3.4.0.
 *  Plugin Support [Muhammad Usama Azad](https://wordpress.org/support/users/usamaazad99/)
 * (@usamaazad99)
 * [3 months ago](https://wordpress.org/support/topic/cloudflare-cache-compatible/#post-18946888)
 * Hi [@leanca](https://wordpress.org/support/users/leanca/) ,
 * I hope you’re doing well.
 * Thank you again for your detailed testing and feedback.
 * Based on your findings, we recommend excluding the Contact Form 7 REST API endpoints
   from Cloudflare caching so that fresh honeypot values can be generated correctly
   for each form submission. Cached JSON responses may cause stale honeypot values
   to be reused, which can result in legitimate submissions being marked as spam.
 * In addition, we have prepared a beta build that includes improvements related
   to the cache issue. This build also includes optimized transient handling, using
   a single transient instead of multiple transients.
 * You can download the beta version here:
 * **[Beta Download](https://drive.google.com/file/d/1T_5rsvTWktX340zyhQR7nxmnpelpGNis/view?usp=sharing)**
 * Please install the updated build and test it on your site. Let us know if the
   issue still occurs after testing, or if you notice anything else unexpected.
 * Thanks again for helping us improve the plugin.
 *  Thread Starter [leanca](https://wordpress.org/support/users/leanca/)
 * (@leanca)
 * [3 months ago](https://wordpress.org/support/topic/cloudflare-cache-compatible/#post-18946898)
 * I think I’ve already lost a lot of clients who couldn’t contact me because the
   contact form wasn’t working, so I won’t risk it with the beta version.
 * Reducing the number of Transients is a good idea, because my Cron job only runs
   once a day, and during that time, several thousand Transients accumulate.
 * Where can I read more about what you’ve changed regarding the cache issue?
 *  Plugin Support [Muhammad Usama Azad](https://wordpress.org/support/users/usamaazad99/)
 * (@usamaazad99)
 * [2 months, 3 weeks ago](https://wordpress.org/support/topic/cloudflare-cache-compatible/#post-18950671)
 * Hi [@leanca](https://wordpress.org/support/users/leanca/) ,
 * Thank you for your feedback.
 * We completely understand your concern about not wanting to test the beta version
   on a live site, especially when the contact form is important for receiving client
   enquiries.
 * Regarding the cache-related changes, these updates are currently included in 
   the beta build and are still being tested. The main changes include optimized
   transient handling, using a single transient instead of multiple transients.
 * We have also made changes to the JSON response handling. Some values that were
   previously static in the JSON data are now generated dynamically, which should
   help improve compatibility with cached environments and reduce the chance of 
   stale honeypot data being reused.
 * At the moment, there is no separate documentation page for these beta changes.
   Once the build is fully tested and released, we will include the details in the
   plugin changelog/release notes.
 * Thanks again for your detailed testing and feedback. It has been very helpful
   in improving the plugin’s compatibility with caching setups.

Viewing 7 replies - 1 through 7 (of 7 total)

You must be [logged in](https://login.wordpress.org/?redirect_to=https%3A%2F%2Fwordpress.org%2Fsupport%2Ftopic%2Fcloudflare-cache-compatible%2F%3Foutput_format%3Dmd&locale=en_US)
to reply to this topic.

 * ![](https://ps.w.org/contact-form-7-honeypot/assets/icon-256x256.png?rev=3328723)
 * [CF7 Apps – Honeypot, Database, Redirection, Webhook, and Addons for Contact Form 7](https://wordpress.org/plugins/contact-form-7-honeypot/)
 * [Frequently Asked Questions](https://wordpress.org/plugins/contact-form-7-honeypot/#faq)
 * [Support Threads](https://wordpress.org/support/plugin/contact-form-7-honeypot/)
 * [Active Topics](https://wordpress.org/support/plugin/contact-form-7-honeypot/active/)
 * [Unresolved Topics](https://wordpress.org/support/plugin/contact-form-7-honeypot/unresolved/)
 * [Reviews](https://wordpress.org/support/plugin/contact-form-7-honeypot/reviews/)

 * 7 replies
 * 2 participants
 * Last reply from: [Muhammad Usama Azad](https://wordpress.org/support/users/usamaazad99/)
 * Last activity: [2 months, 3 weeks ago](https://wordpress.org/support/topic/cloudflare-cache-compatible/#post-18950671)
 * Status: resolved