# Do not expect Cloudflare to cache HTML or JSON merely because it is proxied

> Default extension-based eligibility differs from an application response's MIME type.

- Canonical URL: https://update.dsesecurity.com/updates/do-not-expect-cloudflare-to-cache-html-or-json-merely-because-it-is-proxied/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:16:34+00:00
- Modified: 2026-10-20T18:34:35+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

Default extension-based eligibility differs from an application response's MIME type.

## Potentially affected

This concerns Cloudflare's default CDN cache behavior.

## DSE recommendation

DSE recommends inventorying the actual URL shapes of static assets and application endpoints before setting performance expectations.

## Article

Default extension-based eligibility differs from an application response’s MIME type.

## Source facts

Cloudflare states that its default CDN behavior determines cache eligibility by file extension rather than MIME type and does not cache HTML or JSON by default. Cache Rules can change eligibility. The guide also documents request collapsing for concurrent misses at one data center, where waiting requests share the first origin fetch for the same asset.

Source: [Cloudflare — Default Cache Behavior](https://developers.cloudflare.com/cache/concepts/default-cache-behavior/).

## Applicability

This concerns Cloudflare’s default CDN cache behavior.

## DSE recommendation

DSE recommends inventorying the actual URL shapes of static assets and application endpoints before setting performance expectations. Keep authenticated HTML and user-specific JSON outside broad caching rules unless their cache-key and privacy design is deliberately reviewed. Use a clearly versioned public asset for initial acceptance rather than interpreting a dynamic page’s lack of HIT as a proxy fault. Document any explicit extensionless or HTML caching rule with its owner and intended response classes. Give the performance review an explicit list of endpoints expected to remain dynamic. Ask the reviewer to classify them before looking at hit rate, so healthy uncached application responses are not counted as failed static delivery or used to justify an indiscriminate cache-everything rule.

## Verification

Inspect repeated requests for one default-eligible static asset and one ordinary HTML or JSON endpoint. Compare the resulting status with matching rules and origin headers. If testing request collapsing, use a controlled concurrent workload and origin evidence; do not claim that one observed fetch represents every data center or request pattern.

## Official reference

[Cloudflare — Default Cache Behavior](https://developers.cloudflare.com/cache/concepts/default-cache-behavior/). Reviewed October 20, 2026.

## Primary reference

- Name: Cloudflare — Default Cache Behavior
- Authority: developers.cloudflare.com
- URL: https://developers.cloudflare.com/cache/concepts/default-cache-behavior/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Do not expect Cloudflare to cache HTML or JSON merely because it is proxied,” DSE Security, https://update.dsesecurity.com/updates/do-not-expect-cloudflare-to-cache-html-or-json-merely-because-it-is-proxied/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.