Change DNS last, not first
Add the domain, confirm the origin certificate works, and test the origin directly with a host-header request before you move traffic. Most broken migrations are not CDN problems; they are certificate or redirect problems that only became visible once the proxy was switched on.
Decide what must never be cached
The safe default is to bypass cache for anything that depends on a logged-in cookie, a cart session, or a query string that changes content. WordPress already emits a no-cache header on admin and preview requests, but plugins do not always cooperate.
- Bypass: /wp-admin/*, /wp-login.php, /wp-cron.php and REST write endpoints.
- Bypass: any request carrying a wordpress_logged_in_* or woocommerce_items_in_cart cookie.
- Cache: static assets aggressively, with a long max-age and immutable.
- Cache: anonymous HTML, but purge it on publish, on comment approval and on theme changes.
Roll out in stages
Start with DNS only and caching off. Then enable static asset caching. Then enable HTML caching for anonymous visitors, watching the admin area and a test checkout for a full day at each step. Keep a single command ready to pause the proxy so you can recover in seconds.
Finally, verify the origin is no longer reachable by direct IP. A beautifully configured edge is worthless if attackers can walk around it.