Best Practices

The CDN sits in the critical path of every external request. A CDN outage is a site outage. These patterns keep that risk small and the bill smaller.

Hash Your Asset Filenames

The single most impactful pattern. Filenames change when content changes:

/assets/main.a4f9e21c.css      # immutable; ship a year-long TTL
/assets/main.b3d72ed8.css      # next deploy

Set Cache-Control: public, max-age=31536000, immutable. No purging, ever — the URL of the new version is different, so it's a new cache entry.

Webpack, Vite, Next.js, Rails Sprockets — all do this out of the box. The only thing you must purge is the HTML that references these assets.

Origin Protection

Your origin should not be reachable directly from the internet. Otherwise:

• Attackers bypass the CDN by hitting origin IPs, defeating WAF and DDoS protection.
• A misconfigured DNS record exposes you.
• Cost protection (origin egress fees) is undermined.

Lock it down:

At least one of these is non-negotiable in production.

WAF and Bot Mitigation

CDNs ship with WAF rule sets. Turn them on:

• OWASP Core Ruleset — SQL injection, XSS, common exploits.
• Provider managed rulesets — Cloudflare Managed Rules, Fastly Next-Gen WAF.
• Rate limiting per IP — defaults are too generous; tune per endpoint.
• Bot management — score requests; challenge or block suspicious ones.

Start in detect-only mode, review the dashboard for a week, then flip to enforce. Real users get caught by overzealous WAF rules; tune before enforcing.

DDoS Considerations

All major CDNs absorb L3/L4 DDoS as a baseline service. For L7 (HTTP) DDoS:

• Cache as much as possible — a 200 GB/s attack on cached content is harmless.
• Rate limiting on /login-style endpoints. The expensive ones.
• Bot challenges for routes that shouldn't see bots.
• Anomaly detection — sudden 100× traffic to one path is suspicious.

Test your protections occasionally with a controlled load test from outside your network.

Multi-CDN

When one CDN's outage is unacceptable:

Multi-CDN doubles cost and operational complexity. Reserve for situations where seconds of downtime cost serious money. For most teams, one CDN with auto-failover (CDN to alternate origin) is enough.

Observability

CDNs export logs and metrics; pipe them into your observability stack. Cloudflare Logpush, Fastly real-time logs, CloudFront access logs all dump to S3 / Splunk / a SaaS — see ELK.

Cost Control

CDN bills can surprise. Things to watch:

• Bandwidth out — usually the biggest line item. Higher cache hit rate = lower bill.
• Cache misses to expensive regions — Australia and South America egress to origin is pricey.
• Image transformations — per-transformation cost; cache the transforms.
• Edge functions — per-invocation cost; expensive on cache-miss-heavy traffic.
• Free tier limits — Cloudflare's "free" tier has tight limits for paid features (Workers, Cache Reserve).

Best practices:

Common Pitfalls

Region-Specific Considerations

• China: most Western CDNs work poorly inside the GFW; specific China-tier services (Cloudflare China, Alibaba CDN, ChinaCache) needed. Requires an ICP license.
• Russia: similar but with different sanctions/regulations to navigate.
• South America / Africa: fewer POPs; prefer CDNs with explicit presence there.
• Latency-sensitive APIs: measure real RUM data; the CDN that's fastest globally may not be fastest in your audience's region.

Testing CDN Changes

Three safety nets:

1. Preview / staging environment with the same CDN config as production.
2. Synthetic checks that hit a few representative URLs from multiple regions and alert on cache misses, slow loads, or content drift.
3. Real user monitoring (RUM) — actual visitor latency tracked over time.

A common mistake: change cache rules on Friday, watch the bill on Monday.

Checklist