Purging the Cache
To purge the cache, go to Console → WAF → [your domain] → Cache and click Purge All Cache. The purge propagates to all edge nodes within seconds.
Purging from the console
Section titled “Purging from the console”-
Open Console → WAF → [your domain] → Cache.
-
Click Purge All Cache to refresh all content after a deploy.
-
To clear only specific files, use Purge by URL — enter one or more URLs. It is faster than purging the whole site and preserves your cache hit ratio.
Purging via the API
Section titled “Purging via the API”You can purge the cache from your deployment pipeline:
-
Create a domain API key with the
cache:purgescope under Console → WAF → [your domain] → API Keys (the key starts with thehw_d_prefix). -
Send a cache purge request with that key from your deploy script, so the cache is cleared automatically on every release.
Development mode: work without purging
Section titled “Development mode: work without purging”During active development, instead of purging on every change, enable Console → WAF → [your domain] → Cache → Development Mode. All requests go directly to your origin with no caching applied.
Tuning cache behaviour
Section titled “Tuning cache behaviour”If you find yourself purging often, review these settings first:
- Caching mode — Standard caches only static assets (images, CSS, JS, fonts); Full makes all responses eligible for caching (
Set-Cookieandno-storeheaders are still honoured). - Edge TTL — how long HEIMWALL keeps a response at the edge.
0means automatic: 1800 seconds for static assets, 300 seconds for HTML. - Browser TTL — the
max-agesent to the visitor’s browser. Independent from the edge TTL; keep it short so updates reach clients quickly. - Excluding specific paths — write a rule with the
bypasscacheaction for the relevant path (e.g.http.request.base_uri has_prefix "/api"→ BypassCache). Those paths are never cached, so there is nothing to purge.
Verification
Section titled “Verification”To confirm the purge worked:
- Open the changed page in a private browser window, or check response headers with
curl -I https://yourdomain.com/page. - If content is still stale, clear the browser cache too — the client may hold the old copy until the Browser TTL expires.