Skip to main content

Why Your Super Revalidation Endpoint Still Works Even With Cloudflare

Written by Charlene

Sometimes, when your website is behind Cloudflare, it can be confusing to check if everything is working correctly, especially when using Super and a revalidation endpoint like /api/revalidate.

What was the concern?

When testing the endpoint, the response showed:

  • server: cloudflare

This made it look like the request was not reaching the actual app (Vercel).

Even though Cloudflare appears in the response, the request is still successfully reaching Vercel.

We know this because the response also includes headers like:

  • x-matched-path: /api/revalidate

  • x-vercel-id

  • x-vercel-cache

Simple explanation

Think of it like this:

  • Cloudflare = the security guard at the entrance

  • Vercel = the building behind it

  • Super = someone sending a request to the building

Even if the security guard is visible, they still let the request through to the building.

So seeing “Cloudflare” does NOT mean the request failed.

Important: Allow POST Requests

Super sends revalidation requests to /api/revalidate using the HTTP POST method.

If you are using Cloudflare Access, WAF rules, custom firewall rules, or route-based exceptions, make sure that POST requests to this endpoint are allowed.

A configuration that only permits GET requests may prevent Super from triggering revalidation successfully, even if the endpoint itself is reachable.

When troubleshooting, verify that:

  • The /api/revalidate path is accessible.

  • POST requests are allowed to that path.

  • Cloudflare rules are not blocking or challenging the request before it reaches the origin server.

Do we need to remove Cloudflare?

No. You can safely keep Cloudflare enabled because:

  • It protects your site

  • It does not block the revalidation endpoint

  • The request still reaches Vercel correctly

What Super actually checks

Super does NOT rely on the “server” header.

Instead, it checks whether:

  • The request reaches /api/revalidate

  • Vercel returns the expected response

If those are true, everything is working.

Even if Cloudflare appears in the response, your setup is still working correctly. The revalidation endpoint is reachable, and Super can successfully update your site when changes are made.

Did this answer your question?