The Sucuri Firewall protects your site while improving load times with high performance caching. Faster pages can also improve SEO.
Sucuri offers four caching options. You can see them all under Performance -> Caching Level in the Sucuri Firewall settings.
Which caching level should I use?
To understand which caching level is best suited for your website, use this comparison table:
|
Caching Level |
Recommended site type |
Page caching time |
301 redirect |
302 redirect |
Not found (404) |
Respects your server’s cache headers |
|---|---|---|---|---|---|---|
|
Enabled |
Static websites, no dynamic content, infrequent updates |
180 minutes |
180 minutes |
10 minutes |
4 minutes |
No, except |
|
Minimal |
News portals, blogs, sites updated daily with no user sessions |
8 minutes |
15 minutes |
5 minutes |
2 minutes |
No, except |
|
Site Caching |
eCommerce, forums, membership sites, custom applications |
180 minutes* |
180 minutes |
10 minutes |
4 minutes |
Yes (except static files) |
|
Disabled |
Non-public websites, or websites behind another CDN |
1 minute* |
10 minutes |
10 minutes |
1 minute |
Yes (except static files) |
* For the Site Caching and Disabled caching options, these times are used when your server doesn’t send its own cache control header. If your server sends Cache-Control: max-age=N, the page is cached for N seconds instead. If it sends a header that forbids caching (Cache-Control: private, no-store, no-cache, an Expires date in the past, or Set-Cookie), the page isn’t cached at all. See Investigating Cache Headers for more details.
** On Enabled and Minimal, a page your server marks Cache-Control: private, or a page that sets a cookie, is never cached. Your server’s other cache headers and cache times are ignored.
Note
The Disabled caching level does not mean “no cache”. The firewall still caches pages for 1 minute, but only for visitors without any cookies. Visitors carrying a cookie (for example, a logged-in user or anyone with a session) always get a fresh page.
On Enabled and Minimal, your server’s cache headers are ignored and the cache times from the above table apply. Pages marked
Cache-Control: private, and pages that set a cookie, are never cached. If your site has pages that are different for each visitor (sessions, shopping carts, logins), use Site Caching, or add those pages to the Non-Cache URLs settings.Every caching level skips the cache for logged-in visitors of common platforms (WordPress, WooCommerce, phpBB, vBulletin, XenForo, ASP.NET) for many sensitive pages, such as:
/wp-admin,/login,/cartand/checkout, and form submissions. See Investigating Cache Headers for details.Pages are cached on the second request. A page is stored only after it has been requested twice, so the first two visits after a change or a cache clear always come from your server.
If you are facing caching issues, please make sure you’re using the proper caching level for your website type and refer to the article “Troubleshoot Cache Issues”.
Static Files
Static files (images, CSS, JavaScript, fonts, audio/video, PDFs and documents, archives, .txt and .xml) are cached the same way on every caching level, to help protect your site against DDoS attacks.
-
Cached on the firewall for up to 3 days. A file your server sends with
Cache-Control: privateisn’t cached. -
Cached in visitors’ browsers for 1 day (
Cache-Control: max-age=86400).
Sitemaps and RSS/Atom feeds get 1 hour, androbots.txt,ads.txt,app-ads.txtandsecurity.txtget 5 minutes.
To see changes to static files right away:
-
Version your files: add or change a version query string (for example
style.css?ver=123.1, then?ver=123.2). Each new version is fetched fresh from your server. -
Developer Mode: the firewall skips the cache, including for static files, while Developer Mode is on. Remember to turn it off afterwards.
-
Clear Cache: you can clear the cache at any time, no matter which caching option you’ve chosen. Go to Performance in your Sucuri Firewall settings and select Clear Cache.