Exclude order-sensitive application URLs from Cloudflare Query String Sort

Repeated parameters can carry meaning in their original sequence.

Source facts

Cloudflare documents Query String Sort as normalizing query ordering for cache lookup, including sorting repeated parameter names by value. Applications requiring exact order can behave unexpectedly. Its WordPress example concerns ordered script parameters, while the guide notes newer WordPress versions may include a relevant fix; the behavior must therefore be checked against the installed application.

Source: Cloudflare — Query String Sort.

Applicability

This concerns Cloudflare query sorting.

DSE recommendation

DSE recommends identifying routes whose parameter order affects signatures, script dependencies, or application processing before enabling sorting broadly. Apply the feature only to URL classes where equivalence is established, using a scoped rule when appropriate. Keep administration and authenticated workflows in the acceptance set. Do not interpret improved hit rate as sufficient justification if the origin receives a semantically different request. Ask application owners for one order-sensitive example rather than assuming all query permutations are equivalent. Preserve both the incoming sequence and the origin-observed sequence in the pilot. Make an unexplained content or action difference a reason to exclude that route from sorting.

Verification

In a controlled test, compare the original and reordered forms of representative queries, including duplicate parameter names. Inspect the origin request and returned content or application action. Exercise affected administrative functions and signed URLs where present, then retain the scoped exclusions and observed results instead of relying on a historical WordPress example alone.

Official reference

Cloudflare — Query String Sort. Reviewed October 20, 2026.