Content delivery networks store copies of web content on many servers so people fetch it from a nearby location, which can centralize caching and filtering.
The network is a delivery layer in front of an origin, and it does not replace the need to secure the application and the accounts behind it.
How it works
By absorbing ordinary read traffic, a delivery network can keep an origin calmer and can apply consistent transport protection and basic request filtering at the edge.
Configuration mistakes, such as caching a private page or trusting every header the edge forwards, can expose data or hide the real client from the application.
Outages and bad rules at the delivery layer become your outages, because visitors never reach the origin directly.
Treat the provider as a critical supplier: know how you bypass it in an emergency, who can change cache rules, and how logs get back to your investigators.
Concrete examples
- A global news site serves images from nearby caches so the origin is not hit for every reader during a major story.
- A private invoice page is accidentally cached and then shown to the next person who requests a similar address.
- During a provider incident, the site stays unreachable until staff use a documented path back to the origin.
Protective measures
- Decide which responses may be cached, and never cache authenticated or personal pages unless you have tested that separation.
- Pass a trustworthy client identity to the origin, and do not let callers spoof that identity with a header you forgot to strip.
- Restrict who can edit cache rules, certificates, and origin addresses, and record those changes.
- Document an emergency path to the origin and the provider contacts you will call when the edge itself fails.