Download the PHP package hardimpactdev/cloudflare-cache without Composer

Cloudflare Cache for Laravel

Easy Cloudflare edge caching for Laravel apps:

• Middleware that sets safe Cache-Control headers for public pages
• Purge one URL, many URLs, or an entire zone (sync or queued)
• Optional warming after purge
• Model trait to purge when Filament / Eloquent content changes

Designed for brochure/marketing sites behind Cloudflare — including Laravel Cloud’s Cloudflare edge when you manage the zone yourself for per-URL purge.

Installation

Publish config (optional):

Environment

Create a Cloudflare API token with Zone → Cache Purge limited to the site zone.

Cacheable routes (critical)

Cloudflare will not cache responses that set cookies. Do not put this middleware only on the default web stack.

With Waymaker (recommended)

Keep a single Waymaker-generated routes file. Opt pages into a cookie-free stack with a middleware group:

Per-route override (same controller can mix groups):

StaticMiddleware::defaults() is:

1. SubstituteBindings
2. Your $before stack (Inertia share, etc.)
3. CacheResponse (this package)
4. Your $after stack

Requires Waymaker with middlewareGroup support (see Waymaker changelog / docs).

Without Waymaker

Alias is also registered for classic routes:

Default headers:

Middleware skips: non-GET, non-2xx, authenticated users, requests with an active session (web group), Set-Cookie responses, disabled env / package.

Cloudflare dashboard

For HTML to be eligible, ensure a Cache Everything (or equivalent) rule with Browser TTL: Respect Origin and Edge TTL: Use cache-control header from origin (Respect Origin). Without the Edge TTL setting, Cloudflare may ignore s-maxage and fall back to its own default. Static extensions are cached by Cloudflare by default.

Inertia + SSR (Cloudflare only)

Document visits and Inertia navigations share the same URL:

Cloudflare free/pro does not vary the cache key on X-Inertia. Relying on Vary alone will serve HTML to Inertia navigations — store-side headers alone aren't enough either, so you also need lookup-side Cache Rules on a zone that actually proxies traffic.

This package:

1. Edge-caches document visits only
2. Forces private, no-store when X-Inertia is present
3. Still sets Vary: Accept-Encoding, X-Inertia for correctness elsewhere

Required Cloudflare Cache Rules

Create two Cache Rules, in this order:

1. Bypass Cache when it's an Inertia navigation:

2. Cache Everything for other eligible GETs (the document HTML), with:

   • Browser TTL: Respect Origin
   • Edge TTL: Use cache-control header from origin (Respect Origin)

   The Edge TTL setting matters — without it Cloudflare may ignore s-maxage from this package's headers and fall back to its own default Edge TTL instead.

not len(http.request.headers["x-inertia"]) > 0 is not a valid substitute for rule 1 — len() does not operate on an array-valued header field and won't validate.

DNS for the site must be proxied (orange cloud) on that zone. Grey-cloud DNS (DNS only) means your Cache Rules never run — traffic hits Laravel Cloud’s managed edge instead, which cannot set per-header bypass rules.

Warming fetches document HTML only (no X-Inertia header).

There is no second origin cache in this package — only Cloudflare edge headers, purge, and warm.

Purge

Eloquent / Filament

Or call from Filament:

Artisan

Warming

Off after purge by default (CLOUDFLARE_CACHE_WARM_AFTER_PURGE=false). Enable per call with warm: true, or set the env flag globally. Warming issues cookie-less GET requests so the edge can re-fill quickly after invalidation.

Laravel Cloud note

Laravel Cloud’s built-in edge purge API clears the whole environment. This package targets your Cloudflare zone for precise URL purge (Filament saves). Use both: deploy purge from Cloud, content purge from this package.

If the custom domain is DNS-only to Laravel Cloud, HTML may still be edge-cached by Cloud’s Cloudflare when you send public, s-maxage. Without Cache Rules you control, Inertia navigations will get that HTML — either orange-cloud through your zone with the rules above, or stop sharing HTML at the edge (private) for those pages.

Testing

License

MIT