Cloudflare Head Requests and Set-Cookie Headers: A Guide for Website Owners
Learn how Cloudflare handles cacheable HEAD requests and Set-Cookie responses, and what website owners should check before changing cache settings.
Facts that can change should include a source and check date. Benchmark claims should state the plan, region, method, and test period.
For a cacheable HEAD request that misses Cloudflare’s cache, Cloudflare sends GET to the origin, caches the full response, and returns only the response headers. Cloudflare’s handling of Set-Cookie depends on whether the response is cacheable, the cache settings in use, Origin Cache Control, and any explicit edge-cache TTL. Your origin should support GET, and you should inspect your own response headers and cache status after changing settings.
These behaviors are specific to Cloudflare’s cache system. They should not be assumed to apply to every hosting provider or CDN.
How Cloudflare handles HEAD requests#
A HEAD request asks for response headers without the response body. Cloudflare documents that it converts cacheable HEAD requests into GET requests.
If the resource is not already cached, Cloudflare sends the GET request to the origin, caches the full response, and returns only the headers to the requester. Make sure the origin server can handle GET requests even when a visitor or monitoring tool sends HEAD.
How Cloudflare handles Set-Cookie#
Set-Cookie is a response header that carries cookie instructions from the origin. Cloudflare documents these outcomes:
| Cloudflare condition | Documented result |
|---|---|
| The request is not cacheable | Cloudflare preserves Set-Cookie. |
| The request is cacheable, uses the default cache level, and Origin Cache Control is not enabled | Cloudflare removes Set-Cookie and caches the asset. |
| The request is cacheable, uses the default cache level, and Origin Cache Control is enabled | Cloudflare preserves Set-Cookie, does not cache the asset, and returns BYPASS. |
Cache Everything in Page Rules or Eligible for cache in Cache Rules is used | Cloudflare preserves Set-Cookie but does not cache the asset; the request returns MISS each time. |
| The preceding cache setting is used with an explicitly configured edge-cache TTL | Cloudflare removes Set-Cookie and caches the asset. |
The final condition matters when reviewing an existing rule: an explicit edge-cache TTL can change a cookie-setting response from preserved and uncached to removed and cached.
Checks for website owners#
- Confirm that the origin supports
GETrequests. - Identify pages or files on your site that return
Set-Cookie. - Review Cloudflare cache settings before applying broad caching to cookie-setting responses.
- Pay particular attention to explicit edge-cache TTL settings.
- After changing a rule, inspect the relevant response headers and cache status for your own site.
The table summarizes Cloudflare’s documented behavior; it is not a test result for your site. Testing the affected URLs after a configuration change shows whether your current rules produce the expected headers and cache status.
Sources
- Cloudflare: Head Requests and Set-Cookie Headers Checked 2026-09-23
- Cloudflare cache documentation Checked 2026-09-23