Changelog
July 2026
Dynamic values in response headers
Response header Set and Add values can now embed {{req....}} placeholders that smoxy resolves per request, from the same request data your Conditional Rules match on - the visitor's geo country, IP, host, or a named request header, query arg, or cookie. For example, an Add on Set-Cookie with geo_country={{req.geoip.country}} hands each visitor a cookie carrying their own country. Only request data is reachable, and resolved values are made injection-safe by stripping line breaks. Configure it on the zone's Proxy page, or override per request with a Conditional Rule.
Redesigned rule editing
Access, Rewrite, and Conditional Rules are no longer edited in a dialog. Each rules page now opens an inline editor with the zone's other rules in a collapsible list beside it, structured as When (the conditions) and Then (the action or settings). The highlight is the new settings picker: every setting now shows a short description of what it does plus the zone's current value, so you see exactly what you are about to override for matching requests. Rewrite Rules additionally get a live preview that shows how a sample URL is rewritten.
Zstandard compression
smoxy has always compressed responses at the edge with Brotli and gzip - active on every zone, nothing to configure. Zones can now additionally offer Zstandard (zstd), the newest compression format with smaller files and faster decompression, supported by current Chrome, Edge, and Firefox. Every visitor automatically gets the best format their browser supports (zstd, then Brotli, then gzip). Newly created zones start with zstd enabled; existing zones can switch it on in the new Compression card on the zone's Proxy page - no cache clear required.
Add response headers
The Proxy page now edits response headers as a single list of operations. A new Add operation sends an additional header line while keeping the origin's, so a header can be delivered more than once - the right choice for repeatable headers like Set-Cookie or Vary. It sits alongside Set (replace the origin's header) and Remove (drop it before it reaches the visitor), and can be overridden per request with a Conditional Rule.
Strip cache-tag headers
A zone can now remove its configured cache-tag headers (e.g. x-cache-tags, xkey) from responses before they reach the visitor - on cache hits, misses, and bypasses alike. Useful when exceptionally large tag headers, such as Shopware's xkey, would be rejected by downstream applications. It's off by default; enable it in the Cache key customization card on the zone's Cache page, or override it per request with a Conditional Rule.
Browser cache TTL
A zone can now control how long browsers cache responses delivered by the CDN, sent as the Cache-Control max-age directive. Pick Managed by smoxy (the default) to follow the server-side cache expiration, No browser caching, or a fixed preset between 5 minutes and 1 year that overrides the origin's max-age and the zone's default TTL. Find it in the new Browser cache TTL card on the zone's Cache page.
Cache key: vary by request header
The cache key can now include the values of named request headers, so a request carrying Accept-Language: de and one carrying Accept-Language: en can be cached separately. Add header names under Header Value in the Cache key card on the zone's Cache page, or override the list per request with a Conditional Rule. smoxy normalizes the list on save - trimming entries and removing case-insensitive duplicates, with - and _ treated as the same character. It's off by default.
Cache key: vary by country
The cache key can now include the visitor's country, so visitors from different countries are served separately cached copies of the same URL. The country is resolved by GeoIP from the visitor's IP address. It's off by default; enable Country in the Cache key card on the zone's Cache page, or override it per request with a Conditional Rule.
Server-Timing headers
A zone can now emit a Server-Timing response header that breaks request handling into timing phases - edge time, origin time, and cache status. Real-user-monitoring tools such as fastmon read it to measure smoxy's contribution to page latency in the browser. It's off by default; enable it on the zone's Proxy page.
Redirect map (beta)
A zone can now serve a large list of exact, path-level redirects straight from the edge. Map each source (host/path) to a target with a mode (literal, preserve-query, or host-swap) and status code, manage the list by CSV import and export, and let smoxy validate it - deduping, collapsing chains, and rejecting cycles - on the way in. Find it on a zone under Configuration → Redirects.
Purge by content class
A single BAN request can now clear a whole class of cached content: type: images, type: html, or type: assets. No tagging setup required - smoxy classifies every cached object automatically. And type: all is the new, documented way to clear the entire zone cache (flushall keeps working).
Internal response headers locked down
smoxy's internal s-* response headers are no longer exposed to visitors - they are now stripped at the edge. The s-cache header (HIT/MISS/BYPASS) stays public, and with debug headers enabled all internal headers remain visible for troubleshooting.
Managed ignored URL parameters
smoxy now maintains a curated list of known tracking parameters - UTM tags, advertising click IDs like gclid and fbclid, and parameters from common analytics, email-marketing, and affiliate platforms - that are automatically stripped from the cache key. The list is updated centrally by smoxy and combined with your own exclusions; Conditional Rules can override it per request. New zones have it enabled by default; existing zones can opt in on the Cache page.
Redirect targets can include a path
A redirect target is no longer limited to a hostname: in Domain-only mode it may now include a path and query string (e.g. new-domain.com/spring-sale?campaign=relaunch), sending every request on the source hostname to that exact destination.
Read-only API tokens
Personal access tokens can now be created as read-only. A read-only token can only perform read requests - any write request is rejected - making it the safe choice for monitoring, reporting, and export integrations.
Automatic DNS setup for new hostnames
When you add a hostname that belongs to a domain whose DNS is managed by smoxy, the Hub now offers to create all required DNS records for you - the traffic-routing CNAME and, for auto-managed certificates, any missing SAN together with its validation record. Existing records are never modified.
Rate limiting for BAN/PURGE requests
Cache invalidation requests are now throttled at the edge: up to 5 requests per second are processed immediately, each additional request is delayed by 100 ms. To invalidate everything, send a single Flush All request instead of one request per URL. The Hub API's cache-clear endpoint additionally allows one clear per zone every 5 seconds.
A brand-new Hub
smoxy Hub 2.0 launched on July 2, 2026: the entire interface has been redesigned from the ground up - cleaner, faster, and more consistent across every screen, from the dashboard to rules to security. Everything you already used is here, in a more modern home.
Find anything, instantly
A new search bar lets you search the whole Hub from one place. Look up any zone, domain, certificate, rule - or jump straight to a specific setting - and navigate there in a couple of keystrokes.
API-first
smoxy now ships a full public REST API at https://api.smoxy.eu. Create personal access tokens, authenticate with the X-API-TOKEN header, and automate everything you can do in the Hub - documented in the API Reference.
Managed Security Scenarios
smoxy now maintains a curated, continuously updated set of security scenarios - detection rules that catch behavior like credential stuffing, path scanning, and automated bot attacks. They're on by default and require zero upkeep.
Threat Lookup
Investigate any IP - see its threat score, network info, and a timeline of the scenario events behind every decision - and act on it directly.
Blocklists and Allowlists
Manage per-zone blocklists and allowlists of IPs and CIDR ranges.
Two-factor authentication
Secure your account with 2FA via any authenticator app (TOTP), complete with one-time recovery codes. Organization owners can require 2FA for all members.
A richer zone dashboard
The zone dashboard now shows far more at a glance - seven KPIs, a traffic chart with six switchable views, ranked breakdowns for top hosts, status codes, countries, and URIs, and a live recent-requests table - all scoped by a flexible time-range picker covering up to 30 days.
"Sites" are now "Zones"
The reusable configuration unit you assign to your hostnames is now called a zone. Nothing about how it works has changed - only the name. The documentation and the entire Hub now use "Zone" throughout.
Guided onboarding
New to smoxy? A product tour introduces organizations, zones, and hostnames, and a guided setup walks you through activating your first zone. Replay the tour any time from the (?) menu.
Looking for older entries? Changes before the new Hub are archived by year: 2026, 2025, 2024.