Manage Bot Protection (JS Challenge)
Enable the three-mode bot verification from the Security page, use "Everyone" deliberately, read the pass rate.
CDN.com.tr Help
Read cache status: HIT, MISS, BYPASS, EXPIRED
Use the X-Proxy-Cache-MT response header to see exactly what the CDN did with a request and to verify that caching works as intended.
Cache, security, WAF, and purge
Read cache status: HIT, MISS, BYPASS, EXPIRED
Use the X-Proxy-Cache-MT response header to see exactly what the CDN did with a request and to verify that caching works as intended.
Use cases
A customer checks response headers in browser DevTools and wants to know whether content is being served from the CDN cache, fetched from origin, or deliberately skipped.
Workflow
- Open the page or asset URL and inspect response headers (browser DevTools Network tab or `curl -I`).
- Find the `X-Proxy-Cache-MT` header.
- Match the value with the glossary below.
- Repeat the request: a healthy cacheable URL goes MISS on first request, then HIT.
Checks
- HIT — served from CDN cache without contacting your origin. This is the goal for static and anonymous content.
- MISS — not in cache yet; fetched from origin and stored. The next identical request should be a HIT.
- EXPIRED — was cached but the TTL passed; refetched from origin.
- BYPASS — a skip rule matched this request, so the CDN intentionally went to origin. The most common reason: you are logged in to a panel or CMS, and a session/login cookie disables caching for you. Visitors without that cookie still get HIT.
Frequently asked questions
I always see BYPASS in my browser but caching is supposed to be on — why?
You are almost certainly logged in to the site or panel. Login and session cookies skip the cache on purpose so personalized pages are never cached. Test with a private window or `curl -I https://yourdomain.com/path` — you should see MISS then HIT.
Why does the CDN ignore my origin Cache-Control header?
The cache TTL is controlled by your account cache rules in Advanced Management, not by the origin response header. The origin header is still passed through to browsers. Use Add Rule to set the TTL per path or content type.
Mobile and desktop seem to be cached separately — is that normal?
No. The cache key has no device component — mobile and desktop share one entry, so purging a path clears it for both.
How do I force fresh content for everyone?
Purge the path from Purge Management. A hard refresh in your own browser only affects your browser cache, not the CDN cache.
Related pages
The Security page: WAF, IP and country blocking, hotlink, rate limit
All account-level security controls live on one Security page: the site-wide WAF toggle, JS Challenge bot protection, IP and country blocking, hotlink protection, request rate limiting, and link expiration. Every save deploys to the edge automatically — no separate publish step.
Write cache behavior with Add Rule
Configure domain/path cache key, TTL, methods/statuses, headers/cookies, optimization, and rate-limit rules.
Read WAF logs
Use WAF logs to explain blocked or challenged traffic without exposing internal log systems.
Purge cached content
Purge a path, saved path, or the whole account and separate CDN cache from browser cache.
Cache keys and purge: why "I purged but it's still old" happens
Every cached object is stored under a key built from the request — scheme, host, path, and query string. A purge only clears an entry when it addresses that exact key. Understanding this one idea explains nearly every "purge did not work" case.