How a CDN serves your content

Edge locations, cache hits and misses, origin shielding, and how to tell which layer answered a request.

Edge locations and the origin

A CDN is a network of reverse proxies spread across many locations. DNS or anycast routing sends each visitor to the nearest one. If the content is already cached there, the request never touches your server; if it is not, the edge fetches it from the origin, stores it according to the response headers, and serves it.

# which layer answered, and was it a hit?
curl -sI https://example.com/assets/app.js | grep -i -E "cache-control|age|etag|x-cache|cf-cache-status"

# cf-cache-status: HIT | MISS | EXPIRED | REVALIDATED | DYNAMIC
# x-cache: Hit from cloudfront / Miss from cloudfront
# age: seconds this copy has been in the cache

What a CDN also gives you

• TLS termination close to the visitor, so the slow handshake leg is short.
• Absorption of traffic spikes and simple denial-of-service filtering before requests reach you.
• Compression (Brotli or gzip) applied at the edge, if you are not already compressing at the origin.
• Origin shielding: one edge location fetches on behalf of all others, cutting origin load dramatically.
• Request collapsing: many simultaneous misses for the same URL become a single origin fetch.

# origin: tell the edge how long it may keep the response
location /assets/ {
  add_header Cache-Control "public, max-age=31536000, immutable";
}
location / {
  add_header Cache-Control "public, max-age=0, s-maxage=3600, stale-while-revalidate=60";
}

# and make sure a wrong host header cannot poison the cache
if ($host != "example.com") { return 444; }

When a CDN is not worth it

For a small site with visitors in one country and a host that already runs a fast edge cache, an extra provider adds configuration surface - cache rules, purge tooling, another place for TLS to break - without a measurable win. Measure before adopting one.

• If all traffic is within a few hundred kilometres of one fast region, the latency gain may be under 20 ms.
• If most of your responses are personalised, they will not be cacheable, and the CDN becomes an expensive proxy.
• If you cannot yet set correct cache headers, a CDN will happily cache the wrong things - fix headers first.

FAQ

Related

Cache headers and cache keys Caching and conditional requests

Last refreshed 2026-09-18.