/index.php requests making it through

I had a situation today, I got 1145 requests in 5 minutes from 168 IPs, 92% of the requests were GET /index.php. I would have expected CF to cache these requests for me. The caching summary shows a spike at that time, says CF served 10.56k requests while the origin served 1.84k requests. My cache level was set at Ignore Query String but I’m changing it to Standard. I wouldn’t expect that to help. I spot checked about 10 of the most aggressive IPs - most were from IP blocks owned by Microsoft.
Q) Is there a way to tell if some of this traffic is direct? I suspect it wasn’t, given the large spike seen on the caching summary.

Q) Is it expected/possible that CF might pass traffic to the origin that it could server but for whatever reason can’t at that moment? Is that likely what happened here?

Hi there,

By default Cloudflare will not cache html/php content as it considered dynamic - if you would like to cache non-default static extensions like php - you need to use cache/page rules.

You can read more about what we cache by default here:

& caching html/php

Q) Is there a way to tell if some of this traffic is direct? I suspect it wasn’t, given the large spike seen on the caching summary.

I’m not sure if I fully understand the question here, If you are seeing these requests in your cache summary on Cloudflare, then it would not be going direct to your origin - as we would not be able to gather analytics on these requests.

Q) Is it expected/possible that CF might pass traffic to the origin that it could server but for whatever reason can’t at that moment? Is that likely what happened here?

If you have cache or page rules that make this page to be cached, and it stopped serving from cache unexpectedly, then something unexpected was happening here and would need to be investigated - there shouldn’t be a reason why we would not serve something from cache that you have instructed us to cache and was working at some point.

Hope this helps!

Thank you Damian, that was helpful.