The origin files are clean, but some visitors still see a redirect, injected script or spam page. Cloudflare may hold an infected HTML response, a Worker may alter traffic, or another origin node may still be compromised.
Purging everything first removes useful evidence and can flood the origin with uncached requests.
Compare public and origin responses
Record the public page’s headers, body hash, cache status, Age, data centre code and timestamp. Use a secure authorised method to request the origin with the real host header.
Do not expose the origin IP publicly or bypass access controls casually. Provider/origin testing should follow the site’s architecture.
If the public response is infected and clean origin is consistent, cache/transformation becomes likely.
Check URL and cache-key variants
Test canonical URL, trailing slash, language path, mobile conditions and harmless known tracking variants. Cookies, query strings, device rules and country can produce separate cache objects.
An ordinary purge of one URL may leave a poisoned variant. Do not configure Cloudflare to ignore all query strings; search, language or ecommerce content may vary.
Record exactly which cache key conditions reproduce the issue.
Preserve evidence before purge
Save the infected HTML, response headers and external resource URLs as restricted incident evidence. Do not execute copied scripts.
Capture Cloudflare cache-rule, Worker, redirect and application configuration plus recent account/audit history.
An unknown Worker or rule can regenerate the response after cache purge.
Review Cloudflare account access
Audit users, API tokens, sessions, Workers routes, Transform/Redirect Rules and apps. Revoke unknown access and rotate affected tokens from a clean device.
Use least-privilege API tokens rather than a shared global key. Protect the owner email and enable strong multi-factor authentication.
Do not delete legitimate security or DNS rules without an export and owner review.
Purge targeted objects
After the origin and Cloudflare configuration are clean, purge the exact URLs and known variants. For widespread infected HTML, a broader purge may be justified with origin capacity planning.
Warm only important public pages after purge and inspect their new headers/body. Keep cart, checkout and account excluded from inappropriate full-page caching.
Do not cache maintenance or incident pages indefinitely.
Check other cache layers
The host, WordPress plugin, reverse proxy, browser service worker and multiple origins can each serve old content. Trace the response through every layer.
Clear generated page-builder/minification caches only after their database/file sources are clean.
If one load-balanced origin remains infected, Cloudflare can alternate content even with normal cache behaviour.
Account for browser storage and service workers
A visitor who previously loaded an infected page may retain cached scripts or a service worker even after Cloudflare is clean. Test a fresh disposable profile and inspect registered workers, Cache Storage and local storage for the affected origin.
Remove the malicious worker script from every origin/cache and publish a clean update or unregister path appropriate to the site. Do not tell customers that clearing all browser data is the website repair; the origin must prevent the old worker from controlling future navigations.
Verify ordinary returning visitors receive the clean worker lifecycle as well as fresh visitors.
Verify globally
Test representative Cloudflare regions where available, clean browser profiles and original mobile/referrer conditions. Confirm no old script/domain appears.
Monitor cache changes, Worker deployments and origin hashes. Review Search Console/security warnings separately; reputation does not clear instantly.
When specialist help is needed
Request help when edge and origin disagree, account rules are unknown or only certain regions/devices fail. Send public headers and URLs with tokens removed.
A complete response preserves evidence, cleans origin/configuration and proves every relevant cache variant now serves trusted content.