# Distinguish Cloudflare DYNAMIC from BYPASS before troubleshooting an uncached URL

> The two statuses identify different points in the eligibility decision.

- Canonical URL: https://update.dsesecurity.com/updates/distinguish-cloudflare-dynamic-from-bypass-before-troubleshooting-an-uncached-url/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:16:33+00:00
- Modified: 2026-10-20T18:34:35+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

The two statuses identify different points in the eligibility decision.

## Potentially affected

This concerns Cloudflare CDN response diagnostics.

## DSE recommendation

DSE recommends starting with the request's eligibility rules when the result is DYNAMIC and examining response directives, cookies, and limits when it is BYPASS.

## Article

The two statuses identify different points in the eligibility decision.

## Source facts

Cloudflare documents DYNAMIC as ineligible for cache at request time, such as an unmatched HTML response or an explicit bypass rule. BYPASS means the request was eligible but the response was not cacheable. MISS describes eligible content absent at lookup time. The source also notes that an Age header can originate upstream on an uncacheable response, so it is not conclusive by itself.

Source: [Cloudflare — Cloudflare cache responses](https://developers.cloudflare.com/cache/concepts/cache-responses/).

## Applicability

This concerns Cloudflare CDN response diagnostics.

## DSE recommendation

DSE recommends starting with the request’s eligibility rules when the result is DYNAMIC and examining response directives, cookies, and limits when it is BYPASS. Capture the exact URL, method, relevant headers, rule matches, and timestamp. Do not change several TTL settings before locating the decision stage. Keep Workers, redirects, and WAF-generated responses in view because they can occur before an ordinary cache lookup. Keep a small diagnostic worksheet with separate request-eligibility and response-cacheability columns. Populate it for one DYNAMIC and one BYPASS example before changing configuration. Trace the Age header to its producer rather than using its presence to overrule the more specific cache-status evidence.

## Verification

Repeat a controlled request for an intentionally cacheable test asset and compare the initial and subsequent statuses. Compare it with a deliberately uncached endpoint and inspect origin headers. Record which stage explains each result, and validate the page content separately from the cache-status investigation.

## Official reference

[Cloudflare — Cloudflare cache responses](https://developers.cloudflare.com/cache/concepts/cache-responses/). Reviewed October 20, 2026.

## Primary reference

- Name: Cloudflare — Cloudflare cache responses
- Authority: developers.cloudflare.com
- URL: https://developers.cloudflare.com/cache/concepts/cache-responses/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Distinguish Cloudflare DYNAMIC from BYPASS before troubleshooting an uncached URL,” DSE Security, https://update.dsesecurity.com/updates/distinguish-cloudflare-dynamic-from-bypass-before-troubleshooting-an-uncached-url/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.