Overview
After connecting to WAFGO, the details matter: what gets cached, how requests reach the origin, and how failures are investigated. Classify your content first, then establish delivery rules you can verify.
Match caching to the content
Versioned scripts, images and download packages can benefit from shared caching. Account information, shopping carts and personalized responses need separate treatment. Longer retention is useful only when updates remain correct.
Cache keys
Identify which query parameters, languages or device differences change the response. Exclude irrelevant variation that creates duplicate objects.
Updates and invalidation
Prefer versioned filenames during releases. For stable addresses, define the invalidation scope, verification steps and rollback procedure.
Compression and transport
Distinguish text from already compressed media, and check content negotiation, response headers and actual transferred bytes.
Keep the origin path understandable
Review the origin address, Host header, TLS and timeouts together. Successful cache hits do not prove that cold requests or failover will work correctly.
- Verify that the origin certificate, hostname and protocol agree.
- Test first requests, expired objects and large transfers separately.
- Record connection failures, origin errors and processing time instead of looking only at averages.
Apply access policy at the right boundary
Cache rules decide whether content can be reused; security rules decide whether a request should reach the application. Shared caching must never bypass identity or authorization checks.
Application protection
Combine WAF rules, request rate controls and traffic observations. Introduce changes gradually and investigate false positives.
Transport security
Review both visitor-to-edge and edge-to-origin connections, including certificate renewal and required security headers.
Visibility
Use status codes, cache behavior, regions and origin response times to investigate issues. Keep reporting definitions consistent with the underlying logs.
Make changes verifiable and reversible
For each change, identify the affected domains, paths and objects before testing representative application traffic. Keep the results and change time in your team records.
- Validate a limited domain or resource set before expanding coverage.
- Check desktop, mobile, signed-in and signed-out behavior.
- Retain the previous rules and a documented way to investigate the origin directly.