How CDNs Work
BeginnerA Content Delivery Network (CDN) is a globally distributed network of servers (called edge nodes or Points of Presence) that cache copies of your content close to users. Instead of every user's request travelling to your origin server in Virginia, a user in Tokyo gets the content from a CDN edge server in Tokyo — 5ms instead of 200ms. CDNs reduce latency, absorb traffic spikes, protect against DDoS, and cut your origin server's bandwidth costs.
Think of it like a library branch system
One central library has every book (your origin server). If everyone in the city had to travel to the central library for every book, it would be overwhelmed and travel times would be long. Instead, branch libraries (CDN edge nodes) in each neighbourhood stock copies of the most popular books. Most people get what they need locally. The central library only deals with requests for rare books and keeps branches stocked.
Step by Step
Key Concepts
Point of Presence (PoP)
A CDN data center location. Cloudflare has 300+ PoPs across 100+ countries. AWS CloudFront has 600+ edge locations. Akamai has 4,000+. Each PoP has servers that store cached content and serve requests for the geographic area around it. More PoPs = lower latency for a larger portion of the world's users.
Cache Hit Ratio
The percentage of requests served from CDN cache without hitting your origin. A high hit ratio (95%+) means your CDN is effectively absorbing traffic. Low hit ratio means users are frequently hitting origin — check if your Cache-Control headers are set correctly and if your content is cacheable (no personalisation or auth cookies).
Cache-Control Headers
HTTP headers that control how long content is cached. max-age: seconds until expiry. s-maxage: CDN-specific max-age. public: allow CDNs to cache. private: browser can cache but CDNs should not. no-cache: always revalidate. no-store: never cache anywhere. immutable: the content will never change (for versioned assets).
Origin Pull vs Push
Origin pull (standard): CDN fetches content from your origin on first request and caches it. No action needed to populate the cache. Origin push: you proactively upload files to CDN storage (like AWS S3 + CloudFront). Pull is simpler for websites; push is used for large file distribution (software downloads, video files) where you want guaranteed pre-population.
Edge Compute
Modern CDNs (Cloudflare Workers, AWS Lambda@Edge, Vercel Edge Functions) let you run code at the edge node — not just serve static files. Edge functions can personalise content, run A/B tests, authenticate requests, and rewrite URLs before the request ever reaches your origin. Latency is near-zero since the function runs in the same PoP as the user.
Anycast
A network routing technique where the same IP address is announced from multiple geographic locations. The internet automatically routes packets to the topologically nearest anycast node. CDNs use anycast so that one DNS record routes users to their nearest PoP. If a PoP goes down, anycast routing automatically shifts traffic to the next-nearest one.
SSL/TLS at the Edge
CDNs terminate HTTPS connections at the edge PoP, close to the user. The TLS handshake (which requires multiple round trips) completes in <1ms from a nearby PoP instead of 200ms from a distant origin. The CDN then connects to your origin via HTTPS on its own private network. Edge TLS termination is one of the biggest latency wins for HTTPS websites.
DDoS Mitigation
CDNs absorb DDoS attacks by distributing traffic across hundreds of PoPs. Each PoP can absorb gigabits of traffic. Cloudflare's network capacity is ~321 Tbps — orders of magnitude larger than most DDoS attacks. Even non-CDN traffic (TCP floods, UDP amplification) is dropped at the edge before reaching your origin.
Key Facts
- Cloudflare handles over 50 million HTTP requests per second across its network — more than 20% of all internet traffic flows through Cloudflare.
- A 100ms increase in page load time reduces conversions by 7% (Amazon). CDN-served assets typically load in <50ms from a nearby edge node vs 200–500ms from a distant origin.
- Netflix stores and serves its entire video catalogue from AWS S3 + CloudFront. CDN costs Netflix hundreds of millions per year — but are far cheaper than the bandwidth and server costs of direct delivery.
- The first CDN was built by Akamai in 1998. MIT professor Tom Leighton co-founded Akamai specifically to solve the "hot spot" problem of websites crashing under sudden traffic spikes.
- Content-hashed filenames (bundle.a1b2c3.js) are the gold standard for CDN caching. The filename changes when the content changes, so CDNs can cache the old file forever without stale content issues. No purges needed.
- CDNs can serve video at scale because they cache at the segment level (HLS/DASH video is split into 2–10 second segments). Popular video segments are cached at every PoP; long-tail content is cached on demand.
Real-World Applications
Static asset delivery for web apps
JavaScript bundles, CSS, images, and fonts are deployed to a CDN with long cache durations and content-hashed URLs. A React app built with Vite outputs bundle.abc123.js — this URL is cached by the CDN forever. When you deploy, new bundles get new hashes. Zero purging required.
Video streaming
Video platforms like YouTube and Netflix use CDNs to cache video segments close to viewers. Without CDNs, every 4K stream would require 25 Mbps from a central server to each viewer. With CDNs, the same cached segment is served to thousands of viewers in the same city from the local PoP.
Global API acceleration
Even dynamic APIs benefit from CDN. Edge compute (Cloudflare Workers, Lambda@Edge) runs authentication and routing logic at the edge. Cacheable API responses (product catalogue, public prices) are served from cache at the edge. Non-cacheable requests are forwarded to the nearest origin over the CDN's private backbone network — faster than the public internet.
Geographic access control
CDNs can block or redirect requests based on the requester's country (geo-restriction). A streaming platform can enforce licensing agreements by blocking EU users from US-licensed content. Geo-blocking happens at the CDN edge — no traffic reaches the origin from blocked countries.
Frequently Asked Questions
What types of content should and should not be cached?
Cache: static assets (JS, CSS, images, fonts), versioned API responses (product catalogue, pricing), public pages (blog posts, marketing pages). Do NOT cache: personalised content (user profiles, shopping carts), authenticated API responses, session cookies, payment pages, real-time data. The rule: anything that's the same for all users can be cached; anything user-specific should not.
How do I handle cache invalidation when I deploy?
Best approach: use content-hashed filenames for assets (Webpack, Vite do this by default). The file hash changes when content changes, so CDNs serve the old version at the old URL and the new version at the new URL — no invalidation needed. For un-hashed URLs (HTML files, /api/config), set short max-age (60 seconds) or use CDN cache purge APIs on deploy.
What is the difference between a CDN and a load balancer?
A load balancer distributes traffic across multiple backend servers in your data center. A CDN distributes traffic across edge nodes worldwide and caches responses close to users. They are complementary: CDN → reduces origin hits globally, load balancer → distributes the origin hits that do arrive across your backend fleet. Most large-scale architectures use both.
Does a CDN help with dynamic content?
Not with traditional caching, but modern CDN edge compute does. Cloudflare Workers can run personalisation logic at the edge (A/B testing, feature flags, auth). Some CDNs support micro-caching (caching dynamic responses for 1–5 seconds) to absorb sudden spikes. Even for uncacheable requests, routing through the CDN's private backbone network reduces latency vs the public internet.