A customer adds a product, navigates to another page and sees an empty mini-cart or checkout. Worse, one visitor may receive cart markup cached from another session. These are functional and privacy problems, not acceptable trade-offs for a faster score.
Disable the unsafe cache path through supported controls, then identify whether full-page HTML, fragments or session handling caused the mismatch.
Reproduce with two isolated visitors
Use two separate private browser profiles. Add different products in each and navigate through product, cart and checkout pages.
Record which element is wrong:
- full cart page;
- header cart count;
- mini-cart drawer;
- checkout totals;
- cart restored only after refresh.
Inspect response cache headers and WooCommerce session cookies. Do not use real customer accounts or payment data.
Protect dynamic WooCommerce routes
Cart, checkout and account pages should be excluded from ordinary full-page cache. Confirm exclusions use the current page URLs and language prefixes.
Custom checkout slugs, translated paths or block-based cart pages can fall outside an old rule. CDN cache rules may also override a WordPress plugin’s local exclusions.
Do not cache these pages merely because logged-out tests appear faster. They contain visitor-specific state.
Check cookie-based bypass rules
WooCommerce sets cookies that indicate cart or session state. Page cache should respect the relevant cookies according to the caching provider’s supported WooCommerce configuration.
If the CDN ignores cookies or varies on the wrong set, it may serve public cached HTML to a shopper. Conversely, bypassing for every harmless cookie destroys hit rate.
Use maintained compatibility rules rather than inventing wildcard names from memory. Cookie names and storage behaviour can vary by WooCommerce version and configuration.
Understand mini-cart fragments
Classic WooCommerce themes may use cart fragments to update the header through AJAX after a cached page loads. Newer blocks can use different data APIs.
If the page HTML is cached correctly but the mini-cart stays empty, inspect fragment or Store API requests and console errors. JavaScript delay, nonce caching or a disabled endpoint can prevent the dynamic update.
Do not enable a legacy fragments script globally if the theme uses a different cart block. Confirm the active component first.
Purge contaminated cache entries
If personalised HTML has been cached, disable the faulty rule and purge affected cart, checkout, account and public pages that contain server-rendered cart state. Use targeted purges where the cache design allows it.
Review access or cache logs for unexpected hits on dynamic routes. Avoid preserving a potentially contaminated cache merely to diagnose it later.
Take configuration screenshots or exports before changing rules so the safe state can be reviewed and documented.
Check session persistence independently
When the full cart page is uncached yet contents still disappear, inspect cookies, HTTPS consistency and PHP session/database behaviour. Switching between www and apex domains or HTTP and HTTPS can prevent the expected cookie from being sent.
Database cleanup jobs, security plugins and object-cache failures can also affect WooCommerce sessions. Match timestamps to a controlled test before changing retention settings.
Do not extend session lifetimes indefinitely as a substitute for repairing storage.
Run a complete regression test
Test guest and account carts, quantity changes, coupons, shipping, checkout refresh, return from a payment sandbox and empty-cart behaviour. Repeat across supported languages and mobile navigation.
Confirm cache hits remain available on safe catalogue and content pages while dynamic routes bypass correctly. Monitor orders and cart errors after deployment.
Treat shared or lost carts as urgent
If one visitor can see another visitor’s cart data, disable the responsible public cache rule immediately and investigate exposure according to the business’s incident process.
Request specialist repair when CDN and origin rules conflict, block cart fragments fail or sessions vanish intermittently. Share test steps and sanitised headers first; credentials and customer data require a secure agreed channel.