Sometimes, when your website is behind Cloudflare, it can be confusing to check if everything is working correctly, especially when using Super and a revalidation endpoint like /api/revalidate.
What was the concern?
When testing the endpoint, the response showed:
server: cloudflare
This made it look like the request was not reaching the actual app (Vercel).
Even though Cloudflare appears in the response, the request is still successfully reaching Vercel.
We know this because the response also includes headers like:
x-matched-path: /api/revalidatex-vercel-idx-vercel-cache
Simple explanation
Think of it like this:
- Cloudflare = the security guard at the entrance
- Vercel = the building behind it
- Super = someone sending a request to the building
Even if the security guard is visible, they still let the request through to the building.
So seeing “Cloudflare” does NOT mean the request failed.
Important: Allow POST Requests
Super sends revalidation requests to /api/revalidate using the HTTP POST method.
If you are using Cloudflare Access, WAF rules, custom firewall rules, or route-based exceptions, make sure that POST requests to this endpoint are allowed.
A configuration that only permits GET requests may prevent Super from triggering revalidation successfully, even if the endpoint itself is reachable.
When troubleshooting, verify that:
- The
/api/revalidatepath is accessible. - POST requests are allowed to that path.
- Cloudflare rules are not blocking or challenging the request before it reaches the origin server.
Do we need to remove Cloudflare?
No. You can safely keep Cloudflare enabled because:
- It protects your site
- It does not block the revalidation endpoint
- The request still reaches Vercel correctly
What Super actually checks
Super does NOT rely on the “server” header.
Instead, it checks whether:
- The request reaches
/api/revalidate - Vercel returns the expected response
If those are true, everything is working.
Even if Cloudflare appears in the response, your setup is still working correctly. The revalidation endpoint is reachable, and Super can successfully update your site when changes are made.