Cloudflare Purger

This module adds Cloudflare CDN cache invalidation support by integrating with the Purge module.

Features

Integrates with the Purge module to do the following:

• Adds a "Cache-Tag" HTTP response header to all of Drupal's cacheable responses. The value of the header is a hashed list of all the Drupal cache tags for that response. Cloudflare stores these cache tags along with the cache data for later lookup.
• Uses the Cloudflare API to send a purge-by-tags request to Cloudflare when Drupal invalidates one or more cache tags.

Post-Installation

Dealing with hosting environment response header limitations

This module adds a "Cache-Tag" HTTP response header which may be very large on pages with many cache tags. Some web servers have strict limits on the size of HTTP response headers. Exceeding this limit can cause errors.

To protect from this scenario, this module exposes a container parameter, cloudflare_purger.max_response_header_length. If the Cache-Tag header for a response exceeds this value, the header is not set and the entire response is marked uncacheable by the Cloudflare CDN using the Cloudflare-CDN-Cache-Control header. (Note - other caching layers may continue to cache the response!). Marking it uncacheable in Cloudflare is critical to prevent the page from being cached indefinitely as it won't have any of the cache tag metadata needed to support invalidations.

Example customization

Cloudflare supports individual response header sizes up to 16kB, but the Acquia hosting environment only supports header sizes of 8kB. In order to safely use this module with Acquia hosting, use this configuration in your services.yml file:

  parameters:
    # 8192 - strlen("Cache-Tag: ") = 8181
    cloudflare_purger.max_response_header_length: 8181

This ensures that the the Cache Tag header size remains compliant with both Acquia's origin servers and Cloudflare.

Preventing hash collisions if environments share a common zone

If multiple environments (dev / test / prod, for example) share a common Cloudflare zone and also share a common hash_salt setting, that would risk cross-environment cache purging. For such configurations this module supports a setting, cloudflare_purger_cache_tag_prefix, which can be used to override the cache tag prefix that is used to help ensure uniqueness of cache tags. By using this setting, each environment (dev / test / prod) can have its own unique cache tag prefix set, thus ensuring that cache purges do not break environment isolation.

Example custom prefixes (Acquia Hosting)

Say there are three environments: dev, test, and prod. There is also an environment variable that denotes which environment is which. By adding this to settings.php, each would have its own unique prefix.

  if (isset($_ENV['AH_SITE_GROUP'], $_ENV['AH_SITE_ENVIRONMENT'])) {
    $settings['cloudflare_purger_cache_tag_prefix'] = $_ENV['AH_SITE_GROUP'] . '.' . $_ENV['AH_SITE_ENVIRONMENT'];
  }

API Token Best Practices

As a general rule, limit the token permissions to only include the bare minimum. In the case of this module, only the Purge permission for a particular Zone is required.

Hosts with fixed outbound IP addresses

To further harden the token, always include the outbound IP address(es) of the origin server(s) in the Client IP Address Filtering section. This option will ensure that only the origin server(s) are able to use the token, so even in the event of a token compromise, it cannot be used by bad actors.

Additional Requirements

The Purge and Key modules are required.

Similar projects

The Cloudflare module has a cloudflare_purge sub-module, however this is not compatible with Cloudflare's header and account limits in 2026 and duplicates some functionality from the purger module.

Cloudflare purge is a completely standalone implementation that does not integrate with the Purge module.

Supporting this Module

To come...