# Use the rewritten origin path when purging a Cloudflare cache prefix

> A visitor-facing path can differ from the prefix that identifies stored resources after a transform.

- Canonical URL: https://update.dsesecurity.com/updates/use-the-rewritten-origin-path-when-purging-a-cloudflare-cache-prefix/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:16:44+00:00
- Modified: 2026-10-20T18:34:36+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, Networks & Infrastructure
- Reading time: 2 minutes

## What you need to know

A visitor-facing path can differ from the prefix that identifies stored resources after a transform.

## Potentially affected

This concerns Cloudflare prefix invalidation.

## DSE recommendation

DSE recommends recording the visitor path and rewritten origin path together in the deployment record.

## Article

A visitor-facing path can differ from the prefix that identifies stored resources after a transform.

## Source facts

Cloudflare warns that prefix purges must use the post-transformed origin URL when a Transform Rule changes the path. Prefix input does not accept query strings or fragments, and a directory purge covers resources within that prefix regardless of their query strings. Tiered-cache follow-up responses may show EXPIRED rather than only MISS.

Source: [Cloudflare — ​Purge cache by prefix (URL)](https://developers.cloudflare.com/cache/how-to/purge-cache/purge_by_prefix/).

## Applicability

This concerns Cloudflare prefix invalidation.

## DSE recommendation

DSE recommends recording the visitor path and rewritten origin path together in the deployment record. Choose the narrowest directory boundary that covers the changed release and review neighboring content before purging it. Keep query-specific resources in mind when estimating the origin refill load. Use observed content revisions to judge the result rather than treating one particular cache-status string as the only valid outcome. Make the transformed prefix a reviewed release parameter rather than an operator’s guess during deployment. Include two query variants under that prefix and a neighboring directory in the test set. Use visible revision markers to confirm the intended boundary without depending on a single status code.

## Verification

In a controlled release test, update assets under the chosen origin prefix and retain an unchanged asset outside it. Purge using the documented post-transform value, then request both sets through their public paths. Confirm updated content and the unaffected control, and inspect origin traffic for the expected refill without assuming local browser cache was cleared.

## Official reference

[Cloudflare — ​Purge cache by prefix (URL)](https://developers.cloudflare.com/cache/how-to/purge-cache/purge_by_prefix/). Reviewed October 20, 2026.

## Primary reference

- Name: Cloudflare — ​Purge cache by prefix (URL)
- Authority: developers.cloudflare.com
- URL: https://developers.cloudflare.com/cache/how-to/purge-cache/purge_by_prefix/
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Use the rewritten origin path when purging a Cloudflare cache prefix,” DSE Security, https://update.dsesecurity.com/updates/use-the-rewritten-origin-path-when-purging-a-cloudflare-cache-prefix/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.