Cloudflare adds Vary support to Cache Rules for every plan

Cloudflare has added support for the Vary HTTP response header to Cache Rules, on every plan, the free one included. The company's blog post opens with a familiar complaint: Vary has been called “the ugliest part of HTTP that we haven't yet improved.”

The header exists because one URL can have more than one correct response: a server may send different languages, image formats, or compression schemes to different clients. A cache that ignores Vary can serve HTML to an API client or JSON to a browser, while treating every raw value as distinct scatters one reusable response into thousands of near-identical variants.

What Vary leaves unsaid

Vary tells a cache which request fields may affect a response. It never says what that response represents. Cloudflare's example: an origin serves English, French, and German, and two clients send Accept-Language: en-US, fr;q=0.8 and Accept-Language: fr;q=0.8, en-GB. Both prefer English and may receive identical bytes, yet a cache comparing raw values stores them as separate variants.

The problem compounds across fields: ten values in one field mean ten variants, while ten values across three fields can mean a thousand combinations. An analysis of more than 120 million responses from nearly 50,000 popular sites found almost 3,000 varying on four or more fields — some on 10, 23, or even 47.

Three actions: normalize, passthrough, bypass

In the new model the origin still names the headers in Vary, while the Cache Rule decides how Cloudflare treats each one. Normalize, the recommended default, rewrites Accept, Accept-Language, and Accept-Encoding values before cache matching — lowercasing and sorting them by quality value so equivalent requests share a response. Passthrough keeps raw bytes, including casing, whitespace, ordering, and duplicates, for headers whose exact value changes the response. Bypass does not store the response at all when the origin names that header, and suits Cookie, User-Agent, and other personalized fields. A Vary: * response is never stored.

Configuration and caveats

Vary settings live in Cache Rules (Caching > Cache Rules in the dashboard) and are also available through the Rulesets API in the http_request_cache_settings phase and through Terraform. Cloudflare stresses that responsibility stays with the origin: every cacheable response that can differ by request fields must return the right Vary header consistently, including errors. Changing a rule does not purge existing entries — old variants remain until they expire or are purged, and purging a resource clears all of its Vary variants.