CDN: when a website needs one
A CDN stores copies of a site's files on servers around the world and delivers them to each visitor from the nearest one. This speeds up loading of images, scripts and video and takes load off your server, but it does not make a slow CMS faster and does not replace choosing the right country for your server. Here is when a CDN is really needed and when a single VPS in the right place is enough.
A CDN (content delivery network) is a layer between the visitor and your server. The domain's DNS record points not to the server but to the CDN. The visitor connects to the nearest node of the network, the node serves whatever it has in its cache and fetches everything else from your server, which in this setup is called the origin.
What a CDN does
- Serves static files close to the visitor. Images, CSS, JavaScript, fonts and video load from a node in the same or a neighbouring country rather than from another continent.
- Shortens connection setup. The encrypted connection is established with the nearest node. Even in TLS 1.3 the handshake takes a separate round trip (RFC 8446), and with a 150 ms ping to a server on another continent, the connection alone takes about a third of a second.
- Offloads the server and the network link. If the cache serves 90% of requests, the server gets a tenth of the traffic. This lets you get by with a smaller plan and stay within the traffic limit discussed in the article Bandwidth and traffic: what 1 Gbps and unlimited really mean.
- Absorbs part of the attacks. There is a separate section on this below.
What a CDN does not do
- It does not speed up what is not cached. The cart, the user account area, search, the API and pages for logged-in users are requested from the origin every time. If a page takes two seconds to build because of a slow database, it will take the same two seconds with a CDN. What helps here is a more powerful server or optimization; see the article How much RAM and how many cores a website needs.
- It does not protect a server whose address is known. An attack aimed directly at the origin's IP bypasses the CDN.
- It does not replace backups. The cache holds only some of the files and only for a while; you cannot restore a site from it.
- It adds a dependency. A CDN outage or a mistake in its settings takes the site down just like a server failure.
When a server closer to your visitors is enough
If your visitors are in one country or one region, the simplest way to speed up the site is to put the server there too. Every 100 km in a straight line adds about a millisecond to the ping, and a server in the audience's country usually responds within 5–30 ms. Such a site will get only slightly faster with a CDN and is simpler to set up without one. How to choose a location and check the ping before paying is described in the articles How to choose a country for your server and How to test VPS ping and speed before you pay.
A CDN is needed when the audience is spread across continents, when the site has many heavy files (a catalogue with photos, video, downloads) or when traffic comes in peaks: a sale, a newsletter, a press mention. An alternative for an audience in two or three regions is a server in each. According to the accsly.io catalog as of November 2026, VPS plans are available in 96 countries, 400 hosts have servers in five or more countries and 155 in ten or more, so several locations can be rented from a single host. But several servers have to be kept in sync, whereas a CDN caches files from one.
Caching rules
A CDN decides what to store and for how long based on the response headers from your server, first of all Cache-Control (RFC 9111):
max-ageis how many seconds the response may be stored, ands-maxageis the same but only for CDNs and proxies;privatemeans the response is for one user, so only the browser may store it, not the CDN;no-storemeans do not store it anywhere.
A working scheme for most sites: files with a version in the name (app.3f2a.css) are served with a one-year max-age and the immutable flag (RFC 8246), and the name changes when the file changes. HTML is cached for minutes or not at all. Pages with a session, a cart or personal data are marked private or no-store.
CDNs also have their own defaults. For example, Cloudflare does not cache HTML and JSON, nor responses with a Set-Cookie header or Cache-Control: private. If you enable caching of all pages with a rule that overrides these headers, the CDN may serve one visitor a page generated for another, complete with that person's name and orders. Enable such a rule only for URLs that definitely contain no personal data.
You can check whether a response came from the cache with curl -I https://example.com/app.css: the Age header shows how many seconds the response has been stored, and the CDN reports the cache status in its own header, whose name you will find in its documentation.
CDN and DDoS protection
Large CDNs have network capacity and node counts orders of magnitude greater than a single data centre, so volumetric attacks are spread across the network and do not reach your server. Application-layer attacks are filtered by the CDN with rules: request rate limiting, browser checks, blocking by country or address. This complements the host's protection rather than replacing it: according to the accsly.io catalog as of November 2026, 1,123 of 2,243 hosts with VPS plans state that they offer DDoS protection, and it is usually network-layer filtering. What actually lies behind such a line in a plan is explained in the article DDoS protection: what hosting providers actually give you; plans that include it are collected in VPS with DDoS protection.
Protection through a CDN only works as long as the origin's address is unknown. On the server, allow incoming connections to ports 80 and 443 only from the CDN's address ranges, which every provider publishes. Do not keep mail and other services on the same IP as the site: MX records and email headers reveal the address. After connecting a CDN, change the server's IP if the old one was already in public DNS records, since their history is kept in open databases.
What it costs
The price of a CDN is made up of transferred traffic, the number of requests and additional features. There are three models:
- A free plan with limits on volume or features. It is often entirely enough for a small site. For example, Amazon CloudFront's free plan includes one million requests and 100 GB a month.
- Pay per gigabyte with prices by region. Bunny.net, for example, charges from $0.01 per gigabyte in Europe and North America and 3–6 times more in other regions. In this model, video and large downloads become the main expense.
- A fixed monthly fee for a bundle of traffic and requests, with no extra charge for overage within the plan.
Application protection (WAF), image optimization, log storage and dedicated addresses are paid for separately. Before connecting a CDN, compare its price with the cost of traffic at your host: if the server already includes several terabytes a month and the audience is nearby, you do not need a CDN to save on traffic.
How to connect a CDN without breaking the site
- Choose the setup. You can hand the CDN the domain's entire zone by changing the DNS servers at the registrar, or route only a subdomain for static files through the CDN with a CNAME record, for example
static.example.com. The second option is easier to undo. How these records work is explained in the article Domains and DNS for a server owner. - Set up encryption to the origin. The connection between the CDN and the server must also use HTTPS with certificate verification. A mode in which the CDN connects to the server over HTTP leaves traffic unencrypted on that leg. Certificates are covered in the article SSL certificates: free and paid.
- Pass the visitor's real IP to the server. Otherwise logs, rate limits and fail2ban will see only the CDN's addresses. The CDN passes the address in a header, and the web server has to be configured to trust it only from the CDN's addresses.
- Check the nodes for your audience. Look at the CDN's node map and measure latency from the regions where your visitors are, especially from the countries where most of your audience is. A CDN without nodes near your audience can turn out slower than direct access to the server.