DIY cache warming script vs. managed service: an honest build-or-buy guide

A cache warming script is twenty lines of bash. We should know — warmup.rocks started as one. This guide gives you a working script, explains exactly where it's good enough, and is honest about the point where DIY stops being free and starts being an unmonitored production system. If the script covers your case, use the script. You don't need us.

The script (it really is this simple)

Read the sitemap, request every URL, repeat on a schedule:

#!/usr/bin/env bash
# warm.sh — fetch every sitemap URL through the CDN/cache
curl -s https://example.com/sitemap.xml \
  | grep -oP '(?<=<loc>)[^<]+' \
  | xargs -P 4 -n 1 curl -s -o /dev/null \
      -H 'User-Agent: my-warmer' \
      -H 'Accept-Encoding: gzip, deflate, br'

Add a cron entry (*/30 * * * * /opt/warm.sh) and you have cache warming. For a handful of real setups, this is genuinely all you need.

When the DIY script is the right answer

• Origin page caches. WordPress page cache, Varnish on your own server, nginx proxy_cache, Redis-backed full-page caches — these live in one place, so one crawler from one machine genuinely fills them. Our WordPress and Varnish guides recommend exactly this.
• Single-region audiences. If your visitors, your server and your CDN's nearest edge are all in one metro area, the one edge location your script hits is the one that matters.
• Small, stable sites. Fifty URLs that change weekly don't need per-run verification. Set the cron, forget it.
• Zero budget, some time. A script costs no money. It costs maintenance instead — a fair trade for a side project.

Where the script quietly stops working

1. It warms one edge location out of hundreds

This is the structural limit no amount of scripting fixes. CDNs cache per data center: Cloudflare operates 300+ colos, and your script running in one VPS fills exactly the one closest to that VPS. Your Frankfurt cron job does nothing for a visitor in Sydney — their colo has never seen your pages. Warming all locations requires sending requests from all those regions, which means globally distributed egress — the one part you can't script around on a single machine.

2. It reports success while failing

The script exits 0 whether the CDN answered HIT, MISS, or your WAF served a 403 challenge page. In our measurement of 408,000 warming requests, per-location miss rates between colos varied from 0.0% to 9.4% under identical settings — the kind of thing you only see if every request's cf-cache-status is recorded and compared over time. A warming setup without verification isn't automation, it's hope.

3. Vary, variants and cookies

Caches key on more than the URL. If your stack varies on device type, language or Accept-Encoding, a desktop-UA, brotli-only script warms one variant and your mobile visitors still hit cold cache. And if one endpoint answers your warmer with Set-Cookie, many caches mark the object uncacheable — your script then dutifully "warms" a page that can never be warm. Diagnosing that requires reading cache status headers per URL, which brings you back to point 2.

4. The maintenance bill arrives later

The real cost of DIY isn't writing the script — it's the afternoon three months later when you discover it's been silently broken since a WAF rule change, a sitemap URL moved, or the VPS provider recycled the IP onto a blocklist. Then someone adds retry logic, then rate limiting so the origin doesn't get hammered after a deploy, then a Slack alert, then sitemap-index support… Each step is small; the sum is an in-house product with an audience of one.

Build vs. buy, side by side

How do you decide? Three questions

1. Does your CDN cache your HTML? If not (the Cloudflare default — HTML shows DYNAMIC), fix that first; it's worth more than any warmer. If yes, continue.
2. Are your visitors in more than one region? If they're all in one metro, DIY covers you. If they're spread out, single-location warming leaves most of them cold — that's a distribution problem, not a scripting problem.
3. Would you notice within a day if warming silently stopped? If nobody would check, verification is the feature you're actually buying — the script was never the hard part.

Two "no" answers to questions 2–3: keep the script, spend the money on something else. Otherwise the math is straightforward — the cheapest plan costs less than fifteen minutes of an engineer's time per month, which is less than the cron job's maintenance amortizes to. (And to be transparent about our own incentive here: we sell the managed option. That's exactly why the criteria above are ones you can check yourself, and why our intro guide tells small single-region sites to skip paid warming entirely.)