Varnish VCL Generator

Generate a Varnish 4.1 VCL with a health-checked backend, a PURGE ACL, paths that are never cached, tracking parameters stripped, cookie handling and grace mode.

Free · No sign-up · Your inputs stay in your browser

Input

Generate a Varnish VCL

Backend hostBackend portDefault TTL (s)Used when the backend sends no Cache-Control.Grace (s)How long a stale page may be served while refreshing, or while the backend is down.

Never cache paths starting withAllowed to PURGEStrip utm_, gclid and fbclid from the cache key

Output

default.vcl

1,802 characters

vcl 4.1;

import std;

backend default {
    .host = "127.0.0.1";
    .port = "8080";
    .first_byte_timeout = 60s;
    .probe = {
        .url = "/up";
        .interval = 5s;
        .timeout = 2s;
        .window = 5;
        .threshold = 3;
    }
}

acl purge {
    "127.0.0.1";
    "10.0.0.0"/8;
}

sub vcl_recv {
    if (req.method == "PURGE") {
        if (!client.ip ~ purge) { return (synth(405, "Not allowed")); }
        return (purge);
    }
    if (req.method != "GET" && req.method != "HEAD") { return (pass); }
    if (req.url ~ "^(/c0ns0le|/admin|/login|/cart|/checkout)") { return (pass); }
    if (req.http.Authorization) { return (pass); }

    # Tracking parameters do not change the page; drop them from the cache key
    set req.url = regsuball(req.url, "(\?|&)(utm_[a-z]+|gclid|fbclid|mc_[a-z]+)=[^&]*", "\1");
    set req.url = regsub(req.url, "(\?|&)+$", "");
    set req.url = regsub(req.url, "\?&", "?");

    # Static files never depend on cookies
    if (req.url ~ "\.(css|js|png|jpe?g|webp|avif|svg|woff2?|ico)(\?.*)?$") {
        unset req.http.Cookie;
        return (hash);
    }

    # Keep only the session cookie; anonymous visitors then share one cached page
    if (req.http.Cookie !~ "(laravel_session|wordpress_logged_in|PHPSESSID)") {
        unset req.http.Cookie;
    }
}

sub vcl_backend_response {
    set beresp.grace = 3600s;
    if (beresp.http.Set-Cookie || beresp.http.Cache-Control ~ "(private|no-store)") {
        set beresp.uncacheable = true;
        set beresp.ttl = 120s;
        return (deliver);
    }
    if (beresp.status == 200 && !beresp.http.Cache-Control) {
        set beresp.ttl = 300s;
    }
}

sub vcl_deliver {
    set resp.http.X-Cache = if (obj.hits > 0, "HIT", "MISS");
    unset resp.http.Via;
    unset resp.http.X-Varnish;
}

Cookies are what usually stop Varnish from caching anything: a request with any Cookie header is passed by the built-in VCL, and analytics sets one on every visitor. This keeps only the session cookie, so logged-out traffic is cached and logged-in traffic is not. Test with varnishd -C -f default.vcl, and watch hit rates with varnishstat.

Runs in this browser. Nothing you paste is sent to a server.

About this tool

Method, assumptions, practical next steps, and limits.

Cookies decide your hit rate

Varnish's built-in logic passes any request with a Cookie header and refuses to cache any response with Set-Cookie. Analytics and consent banners set cookies for every visitor, so without cookie handling nothing is cached. Keeping only the session cookie, as this VCL does, caches logged-out traffic and passes logged-in traffic. The hit rate guide explains the built-in rules.

Grace keeps the site up

With grace, Varnish serves a stale object while it fetches a fresh one in the background, and keeps serving it if the backend is down, within the grace period.

Frequently asked questions

How do I check a VCL for errors?

varnishd -C -f default.vcl compiles it and prints the generated C or the first error. Load it on a running instance with varnishadm vcl.load and vcl.use.

How do I see whether a request was a hit?

The X-Cache header added in vcl_deliver shows HIT or MISS. varnishstat shows the hit ratio, and varnishlog shows why a request was passed.

Is what I paste sent anywhere?

No. The tool runs entirely in your browser with JavaScript. Nothing you type or paste is sent to our server or stored.

Varnish VCL Generator

Generate a Varnish VCL

default.vcl

Cookies decide your hit rate

Grace keeps the site up

Frequently asked questions

Suggested reading

Shell Script Security From Quoting to Least Privilege

Debugging Shell Scripts From set x All the Way to strace

Portable Shell Scripts and POSIX sh Versus Bash in Practice

Similar tools

Hex Viewer

Check Digit Calculator

Dependabot Config Generator