Changelog
July 2026
Strip cache-tag headers
A zone can now remove its configured cache-tag headers (e.g. x-cache-tags, xkey) from responses before they reach the visitor - on cache hits, misses, and bypasses alike. Useful when exceptionally large tag headers, such as Shopware's xkey, would be rejected by downstream applications. It's off by default; enable it in the Cache key customization card on the zone's Cache page, or override it per request with a Conditional Rule.
Browser cache TTL
A zone can now control how long browsers cache responses delivered by the CDN, sent as the Cache-Control max-age directive. Pick Managed by smoxy (the default) to follow the server-side cache expiration, No browser caching, or a fixed preset between 5 minutes and 1 year that overrides the origin's max-age and the zone's default TTL. Find it in the new Browser cache TTL card on the zone's Cache page.
Cache key: vary by request header
The cache key can now include the values of named request headers, so a request carrying Accept-Language: de and one carrying Accept-Language: en can be cached separately. Add header names under Header Value in the Cache key card on the zone's Cache page, or override the list per request with a Conditional Rule. smoxy normalizes the list on save - trimming entries and removing case-insensitive duplicates, with - and _ treated as the same character. It's off by default.
Cache key: vary by country
The cache key can now include the visitor's country, so visitors from different countries are served separately cached copies of the same URL. The country is resolved by GeoIP from the visitor's IP address. It's off by default; enable Country in the Cache key card on the zone's Cache page, or override it per request with a Conditional Rule.
Server-Timing headers
A zone can now emit a Server-Timing response header that breaks request handling into timing phases - edge time, origin time, and cache status. Real-user-monitoring tools such as fastmon read it to measure smoxy's contribution to page latency in the browser. It's off by default; enable it on the zone's Proxy page.
Redirect map (beta)
A zone can now serve a large list of exact, path-level redirects straight from the edge. Map each source (host/path) to a target with a mode (literal, preserve-query, or host-swap) and status code, manage the list by CSV import and export, and let smoxy validate it - deduping, collapsing chains, and rejecting cycles - on the way in. Find it on a zone under Configuration → Redirects.
Purge by content class
A single BAN request can now clear a whole class of cached content: type: images, type: html, or type: assets. No tagging setup required - smoxy classifies every cached object automatically. And type: all is the new, documented way to clear the entire zone cache (flushall keeps working).
Internal response headers locked down
smoxy's internal s-* response headers are no longer exposed to visitors - they are now stripped at the edge. The s-cache header (HIT/MISS/BYPASS) stays public, and with debug headers enabled all internal headers remain visible for troubleshooting.
Managed ignored URL parameters
smoxy now maintains a curated list of known tracking parameters - UTM tags, advertising click IDs like gclid and fbclid, and parameters from common analytics, email-marketing, and affiliate platforms - that are automatically stripped from the cache key. The list is updated centrally by smoxy and combined with your own exclusions; Conditional Rules can override it per request. New zones have it enabled by default; existing zones can opt in on the Cache page.
Redirect targets can include a path
A redirect target is no longer limited to a hostname: in Domain-only mode it may now include a path and query string (e.g. new-domain.com/spring-sale?campaign=relaunch), sending every request on the source hostname to that exact destination.
Read-only API tokens
Personal access tokens can now be created as read-only. A read-only token can only perform read requests - any write request is rejected - making it the safe choice for monitoring, reporting, and export integrations.
Automatic DNS setup for new hostnames
When you add a hostname that belongs to a domain whose DNS is managed by smoxy, the Hub now offers to create all required DNS records for you - the traffic-routing CNAME and, for auto-managed certificates, any missing SAN together with its validation record. Existing records are never modified.
Rate limiting for BAN/PURGE requests
Cache invalidation requests are now throttled at the edge: up to 5 requests per second are processed immediately, each additional request is delayed by 100 ms. To invalidate everything, send a single Flush All request instead of one request per URL. The Hub API's cache-clear endpoint additionally allows one clear per zone every 5 seconds.
A brand-new Hub
smoxy Hub 2.0 launched on July 2, 2026: the entire interface has been redesigned from the ground up - cleaner, faster, and more consistent across every screen, from the dashboard to rules to security. Everything you already used is here, in a more modern home.
Find anything, instantly
A new search bar lets you search the whole Hub from one place. Look up any zone, domain, certificate, rule - or jump straight to a specific setting - and navigate there in a couple of keystrokes.
API-first
smoxy now ships a full public REST API at https://api.smoxy.eu. Create personal access tokens, authenticate with the X-API-TOKEN header, and automate everything you can do in the Hub - documented in the API Reference.
Managed Security Scenarios
smoxy now maintains a curated, continuously updated set of security scenarios - detection rules that catch behavior like credential stuffing, path scanning, and automated bot attacks. They're on by default and require zero upkeep.
Threat Lookup
Investigate any IP - see its threat score, network info, and a timeline of the scenario events behind every decision - and act on it directly.
Blocklists and Allowlists
Manage per-zone blocklists and allowlists of IPs and CIDR ranges.
Two-factor authentication
Secure your account with 2FA via any authenticator app (TOTP), complete with one-time recovery codes. Organization owners can require 2FA for all members.
A richer zone dashboard
The zone dashboard now shows far more at a glance - seven KPIs, a traffic chart with six switchable views, ranked breakdowns for top hosts, status codes, countries, and URIs, and a live recent-requests table - all scoped by a flexible time-range picker covering up to 30 days.
"Sites" are now "Zones"
The reusable configuration unit you assign to your hostnames is now called a zone. Nothing about how it works has changed - only the name. The documentation and the entire Hub now use "Zone" throughout.
Guided onboarding
New to smoxy? A product tour introduces organizations, zones, and hostnames, and a guided setup walks you through activating your first zone. Replay the tour any time from the (?) menu.
Looking for older entries? Changes before the new Hub are archived by year: 2026, 2025, 2024.