Cache & Access

Cache Layers

Layer	Where	What It Caches	Invalidation
Browser	Visitor device	CSS, JS, images	Versioned asset URL, hard refresh
LiteSpeed Cache	GC-US-M10	WordPress pages, GP Elements output	wp litespeed-purge all
PHP OPcache	GC-US-M10	PHP bytecode	wp flush-opcache flush
Cloudflare	Edge network	HTML pages, static assets	API purge or dashboard

Always clear all four layers in order when a change is not visible after a deploy.

Cloudflare Configuration

• DNS: Proxied (orange cloud) for all id86.net subdomains.
• SSL: Full (strict), origin cert managed by OpenLiteSpeed.
• Cache: Standard browser cache TTL; purge via API after deploys.
• WAF: Cloudflare WAF active for threat protection.
• Access (Zero Trust): Protects the public site and subdomains with email OTP.

Cloudflare Access Applications

The id86.net zone has 60+ Access applications. Key ones:

App	Domain	Policy
Access - id86.net	id86.net	Email OTP, donnyaw@gmail.com
Access - sites.id86.net	sites.id86.net	Email OTP, donnyaw@gmail.com

Access verification returns a 302 redirect to rezriz.cloudflareaccess.com/cdn-cgi/access/login/... for unauthenticated requests.

Cloudflare Cache Purge

source /home/rezriz/.ssh/cloudflare/.env
zone_id=$(curl -sS -H "Authorization: Bearer $CF_FULL_CONTROL_TOKEN" \
  "https://api.cloudflare.com/client/v4/zones?name=id86.net" | jq -r '.result[0].id')
curl -sS -X POST "https://api.cloudflare.com/client/v4/zones/$zone_id/purge_cache" \
  -H "Authorization: Bearer $CF_FULL_CONTROL_TOKEN" \
  -H "Content-Type: application/json" \
  --data '{"purge_everything":true}'

Operational Caution

• Do not disable Cloudflare Access to test visual changes. Use origin verification from the production host instead.
• Public browser automation (Playwright) is blocked by Cloudflare Access. Use authenticated sessions for visual review.