Admin Fix

Case Study: Cloudflare COEP Header Breaking Magento WYSIWYG Editor

Client: Bigwicks Ltd · Platform: Magento 2.4.x · Area: Admin / Product Management

Summary

Following a sudden inability to save product descriptions in Magento’s admin, all attempts to isolate the issue pointed to no apparent PHP or MySQL errors. The site compiled, deployed, and cached correctly — yet saving text within the WYSIWYG editor silently failed.

Diagnosis

Through console inspection, multiple CORS and COEP violations were detected referencing Cloudflare endpoints such as /cdn-cgi/speculation and /cdn-cgi/rum. These were linked to Cloudflare’s Speculation Rules and browser isolation policies, which interfered with Magento’s admin JavaScript and TinyMCE loading behaviour.

Solution

The issue was resolved without disabling Cloudflare entirely by filtering the problematic injected headers and endpoints using server rules. Once added, Magento’s WYSIWYG and product saving functions resumed normal operation.

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{REQUEST_URI} ^/cdn-cgi/speculation [NC,OR]
    RewriteCond %{REQUEST_URI} ^/cdn-cgi/rum [NC]
    RewriteRule .* - [F,L]
</IfModule>

<IfModule mod_headers.c>
    Header always unset Cross-Origin-Embedder-Policy
    Header always unset Cross-Origin-Opener-Policy
    Header always unset Cross-Origin-Resource-Policy
    Header always unset Speculation-Rules
</IfModule>

Result

Magento admin text saving restored immediately
Checkout and payment modules verified post-fix
Confirmed root cause: Cloudflare COEP / Speculation Rules conflict
Fix documented for other Cloudflare + Magento sites

Takeaway

This incident demonstrates that not all “Magento bugs” are Magento’s fault — sometimes upstream CDN changes can cause silent breakage at browser level. The solution required understanding both Magento’s security model and modern web isolation policies.

Was this fix useful?

← Back to Rubens Design

Want to understand why this issue happened in the first place?

→ When CDNs Break Your Admin: Understanding COEP, CORP, and Cloudflare’s Speculation Rules