Manage Bot Protection (JS Challenge)
Enable the three-mode bot verification from the Security page, use "Everyone" deliberately, read the pass rate.
CDN.com.tr Help
Read cache status: HIT, MISS, BYPASS, EXPIRED
Use the X-Proxy-Cache-MT response header to see exactly what the CDN did with a request and to verify that caching works as intended.
Cache, security, WAF, and purge
Read cache status: HIT, MISS, BYPASS, EXPIRED
Use the X-Proxy-Cache-MT response header to see exactly what the CDN did with a request and to verify that caching works as intended.
Use cases
A customer checks response headers in browser DevTools and wants to know whether content is being served from the CDN cache, fetched from origin, or deliberately skipped.
Workflow
- Open the page or asset URL and inspect response headers (browser DevTools Network tab or
curl -I). - Find the
X-Proxy-Cache-MTheader. - Match the value with the glossary below.
- Repeat the request: a healthy cacheable URL goes MISS on first request, then HIT.
Checks
- HIT — served from CDN cache without contacting your origin. This is the goal for static and anonymous content.
- MISS — not in cache yet; fetched from origin and stored. The next identical request should be a HIT.
- EXPIRED — was cached but the TTL passed; refetched from origin.
- BYPASS — a skip rule matched this request, so the CDN intentionally went to origin. The most common reason: you are logged in to a panel or CMS, and a session/login cookie disables caching for you. Visitors without that cookie still get HIT.
Frequently asked questions
I always see BYPASS in my browser but caching is supposed to be on — why?
You are almost certainly logged in to the site or panel. Login and session cookies skip the cache on purpose so personalized pages are never cached. Test with a private window or curl -I https://yourdomain.com/path — you should see MISS then HIT.
Does the CDN honour my origin Cache-Control header?
It depends on the rule — the two are mutually exclusive. With Use browser cache time on (the default for new accounts), the origin's Cache-Control, s-maxage or Expires sets the edge TTL and the header reaches the browser unchanged. Set a Cache Expire Time and that rule ignores the origin's cache headers, and rewrites the one the browser gets with your value instead. Two traps: a response carrying Set-Cookie is never cached however correct its Cache-Control is; and where Image Optimization is on, for the account or for the rule, images are held for 365 days whatever the origin says.
Mobile and desktop seem to be cached separately — is that normal?
No. The cache key has no device component — mobile and desktop share one entry, so purging a path clears it for both.
How do I force fresh content for everyone?
Purge the path from Purge Management. A hard refresh in your own browser only affects your browser cache, not the CDN cache.
Related pages
The Security page: WAF, IP and country blocking, hotlink, rate limit
All account-level security controls live on one Security page: the site-wide WAF toggle, JS Challenge bot protection, IP and country blocking, hotlink protection, request rate limiting, and link expiration. Every save deploys to the edge automatically — no separate publish step.
Block traffic by ASN and by country
Two account-wide blacklists on the same panel: block whole countries by country code, or block whole networks by autonomous system number. A blocked visitor gets the branded 403 page with a Reference ID.
Turn on HSTS for your hostnames
The Hsts security preset makes the edge send Strict-Transport-Security: max-age=31536000 on HTTPS responses, so a browser that has seen your site once refuses to open it over plain HTTP for a year.
Write cache behavior with Add Rule
Configure domain/path cache key, TTL, methods/statuses, headers/cookies, optimization, and rate-limit rules.
Read WAF logs
Use WAF logs to explain blocked or challenged traffic without exposing internal log systems.
Purge cached content
Purge a path, saved path, or the whole account and separate CDN cache from browser cache.
Cache keys and purge: why "I purged but it's still old" happens
Every cached object is stored under a key built from the request — scheme, host, path, and query string. A purge only clears an entry when it addresses that exact key. Understanding this one idea explains nearly every "purge did not work" case.
Signed URLs: links that expire
Protect a file so it can only be fetched with a signature you generate, valid until a moment you choose. Unsigned requests get 403, expired ones get 410.
Image optimization: AVIF and WebP at the edge
Switch on image optimization for the account or for one delivery rule and choose WebP or WebP + AVIF: the edge converts JPEG and PNG images and sends each browser a format it accepts, while your pages keep the same image URLs.