Every option, in plain words.

Route

Edge hostname

The name visitors request. It is only validated as a hostname — no DNS lookup is performed, so a typo that happens to look like a domain will pass.

Origin hostname

Where the edge fetches on a cache miss. It must differ from the edge hostname; pointing an edge at itself produces a request loop, and the builder refuses that.

Origin scheme

https encrypts the hop between edge and origin. http is accepted but flagged, because that leg then travels in the clear.

Route path

The prefix this rule covers. / covers everything under the hostname.

Host pin

With the pin on, the generated server block answers only requests whose Host matches the edge hostname. Leave it off when one listener intentionally serves several names.

Caching

Static asset TTL

How long the edge keeps CSS, JS, images, fonts and video. These are the responses worth holding for a long time, because their URLs usually change when the content does.

Document TTL

How long the edge keeps HTML and everything that is not a recognized asset. Keep it short: it is the delay between editing a page and visitors seeing the edit. Anything above a few minutes is flagged.

Browser TTL

The max-age sent to the visitor. Once a browser has a copy, purging the edge does not reach it — the copy lives until it expires. A browser TTL longer than the edge TTL is flagged for that reason.

Query string in the cache key

Ignore gives one cache entry per path, which is usually right for static assets. Listed keys only keeps the parameters that genuinely change the response. Full query string is flagged, because campaign and tracking parameters then multiply the entries for identical content.

Bypass cookie

Requests carrying this cookie skip the cache entirely. Without one, a logged-in response can be stored and served to the next anonymous visitor unless the origin marks it private.

Request methods

Read-only rejects writes at the edge with 405. Forwarding every method passes writes through uncached, so the origin must be sized for them.

Respect origin headers

On, Cache-Control and Expires from the origin win and the TTLs above apply only where the origin is silent. Off, the generated configuration ignores those headers and enforces the TTLs.

Serve stale on error

Lets the edge keep answering from an expired copy while the origin is down or timing out. Stale content beats an error page for most static sites; it is wrong where correctness matters more than availability.

Delivery

Rate limit

Requests per second per client IP, with a burst twice that size. A single page load can pull dozens of assets at once, so very low values throttle ordinary visitors — under 5 req/s is flagged.

Access-Control-Allow-Origin

Blank sends no CORS header. A full origin such as https://app.example.com allows that site. * allows every site and is flagged — it belongs on public static assets and nowhere near authenticated responses.

Compress

Adds gzip for text types. Images and video are already compressed and are excluded.

Strict-Transport-Security

Tells browsers to use HTTPS for a year. Combining it with an HTTP origin is inconsistent and is flagged, though it is not fatal.

Reading the review

Findings come in three kinds. An error means the configuration cannot work as written — a missing hostname, an edge pointed at itself, a cache key mode with no keys. A check means it will work but something deserves a second look. A note is a consequence worth knowing about. Output is generated even when errors are present, so you can see exactly what the broken values produce.

Every check reads only the form. The builder cannot resolve DNS, test a certificate, reach your origin or measure a hit ratio, so it never claims to.

Output formats

The nginx tab emits a server block with a proxy_cache_path, a cache-key map, an optional limit_req_zone and a separate location for static extensions. The Varnish tab emits a VCL 4.1 file with vcl_recv, vcl_backend_response and vcl_deliver. The JSON tab is the same decisions as data, for feeding your own tooling.

Paths in the generated files — the cache directory and the TLS certificate pair — are placeholders. Point them at real locations before using anything.

Saved zones

Saving stores the form values in IndexedDB in this browser on this origin. Another browser, device or origin has its own separate list. Saving under an existing name overwrites that zone, and deleting is immediate and permanent — there is no undo and no version history. Private browsing, storage eviction and clearing site data all erase the list, so keep downloaded copies of anything that matters.

If something fails

If saving reports that storage is unavailable, check that site data is not blocked and close other tabs of this page before reloading. If storage is full, delete zones you no longer need or free up browser storage. If the clipboard is blocked, select the text in the output box and copy it by hand — the download button writes the same bytes to a file.