The guide library.
Step-by-step technical references, written from practice, stamped with a last-verified date — and each one ends with a worksheet you can take into the room.
- Run your first CDN benchmark
- How to read a CDN contract
- Negotiate your CDN renewal
- The migration cutover checklist
- Measure cache-hit ratio properly
Trusted by 100+ enterprises worldwide
Technical guides, verified and dated.
How-to references written from practice: benchmarks, contracts, migrations, security and multi-CDN operations. Each guide carries a last-verified date and ends with a worksheet you can take into the room. New guides publish in batches — one hundred and six live today, the full library is on its way.
How to find out which CDN a website uses.
Five layers of evidence, in the order a working engineer should check them.
How to manage AI crawlers at the edge.
Three categories, three policies — and the block that takes your search traffic with it.
How to run customer custom domains on a CDN.
Delegation, certificates and tenant routing when every customer brings their own hostname.
How to tune origin keepalive and connection reuse.
Stop paying a TCP and TLS handshake on every cache miss. Size the pool, match the timeouts.
Multi-signer DNSSEC across two DNS providers.
Two providers is the resilience play DNSSEC used to block. RFC 8901 fixed that. The two patterns that work.
Lock down your origin with mutual TLS.
A hidden origin is not a protected one. Make it refuse every connection that is not your CDN.
How to run your first CDN benchmark in one afternoon.
A step-by-step method for benchmarking CDN candidates against your real traffic.
How to read a CDN contract: the eight clauses that matter.
The eight contract clauses that decide what a CDN deal really costs.
CDN migration: the zero-downtime cutover checklist.
A staged CDN cutover plan.
Cache-hit ratio: how to measure it properly (and what's good).
Request hit ratio versus byte hit ratio, where each is reported, what values are healthy per content type, and.
Choosing a CDN for video streaming: what actually matters.
The criteria that decide video CDN selection.
The CDN security baseline: what to switch on before launch.
The edge security settings every deployment should enable.
Multi-CDN failover: a working setup, step by step.
How to run two CDNs with automatic failover.
How to negotiate a CDN renewal: timeline, levers, numbers.
A 120-day renewal playbook.
CDN logs: what to collect, where to keep it, what it costs.
The edge log fields worth keeping, retention tiers that balance cost against investigations, delivery options .
Delivering into mainland China: licenses, options, timelines.
What ICP filing and licensing actually require, the three delivery architectures available to foreign companie.
How to write CDN requirements: a one-page template that works.
Replace the feature wishlist with workloads, numbers and disqualifiers that actually separate vendors.
How to shortlist CDNs: from thirty vendors to three in a week.
A five-day elimination method that turns the whole vendor field into three testable candidates.
How to run a CDN free trial properly: a 14-day test plan.
Turn 14 trial days into an experiment: real traffic, deliberate failures, verdicts written before expiry.
How to estimate CDN costs before you commit: the TCO worksheet.
Six line items, your traffic profile, and the sensitivity checks that catch bill surprises early.
How to read CDN coverage maps critically: POPs vs reality.
Dots vs served traffic, peering vs presence — the questions that turn a map into evidence.
How to set up your first pull zone: origin to edge in an hour.
The provider-agnostic first hour: origin, zone, TLS, verify it's actually caching, cut over.
How to configure DNS for a CDN: CNAME, apex and TTL choices.
Subdomain CNAMEs, the apex problem, TTL strategy — the records that keep your estate flexible.
How to put a CDN in front of WordPress without breaking it.
The cookie and admin exclusions, publish-time purging, and the checks before you trust it.
How to CDN an e-commerce store: dynamic pages, carts and cache rules.
The four-tier content model, cart-safe rules, and sale-day preparation for stores.
How to serve a single-page app through a CDN correctly.
Immutable bundles, fresh index.html, route fallbacks and deploys that never strand users.
How to CDN your API: what to cache, what never to.
What the edge buys at zero caching, which endpoints can micro-cache, and the rules that keep it safe.
How to work with a CDN advisor or reseller: what to expect and demand.
What the indirect channel actually does, where its economics come from, and what to demand.
How to plan a CDN proof-of-concept: success criteria that bite.
Criteria before access, numbers on thresholds, failure days in scope — PoCs that produce decisions.
How to design cache keys: the checklist that controls your bill.
What belongs in the key, what to normalize out, and the audit that finds fragmentation.
How to set TTLs: a decision tree for every asset class.
Four questions that land every asset class on a defensible number, not folklore.
How to use Cache-Control properly: the directives that actually matter.
What each directive really means — including the ones everyone misreads — and the combinations to memorize.
How to implement stale-while-revalidate and serve-stale safely.
SWR and stale-if-error per platform, the windows to choose, and rails for content that must not lie.
How to purge without pain: tags, wildcards and workflows.
The three purge types, surrogate-key design, event wiring, and stampede protection.
How to version static assets: cache-busting that never breaks.
Content hashes vs query versions, the reference chain rule, deploy order and retention windows.
How to raise cache-hit ratio: ten levers in order of impact.
Ten ranked levers from key normalization to HTML caching, each with its expected gain.
How to cache HTML safely: rules for pages that change.
The anonymous split, bypass rules, personalized-fragment patterns and pre-launch leak tests.
How to handle cookies and Vary without shredding your cache.
Cookie rules that separate session from noise, Vary's legitimate uses, and the audit for both.
How to configure origin shield: when, where and how.
The three signals it pays, shield placement, per-platform cost shapes, and verifying the collapse.
How to compress at the edge: Brotli, gzip and Zstandard settings.
What to compress, the two-track level strategy, variant caching, and where Zstandard stands.
How to serve images through a CDN: formats, variants, optimization.
The format ladder, URL-based variants, responsive sizing, and metering that controls cost.
How to cache fonts and third-party assets: the overlooked wins.
Font subsetting and self-hosting, the end of the shared-cache myth, and taming the third-party tail.
How to enable HTTP/3 and verify it's actually serving.
Alt-Svc, the toggle, and the three checks that prove QUIC is carrying real traffic.
How to tune TLS at the edge: resumption, OCSP and chains.
The handshake is a tax on every new connection. Resumption, stapling and a lean chain cut it.
How to use Early Hints and preload headers for real gains.
Use the server think-time. What to hint, what to skip, and how to measure the LCP shift.
How to measure TTFB properly: edge vs origin attribution.
One number, five ingredients. Split DNS, connect, TLS, edge and origin before blaming anyone.
How to run synthetic monitoring that doesn't cry wolf.
Fewer checks, better placed, with alert rules a human can defend at 3 a.m.
How to deploy RUM: beacon, sampling and the dimensions that matter.
Field data is the truth. Ship the beacon safely, sample sanely, and tag every beacon with the splits you'll need.
How to read a CDN log line: the fields that explain performance.
Cache status, timing pairs, bytes and protocol — the grammar of the edge, one line at a time.
How to benchmark CDNs against each other fairly.
Same origin, same config, same clients, warmed caches — or the numbers are theatre.
How to debug a slow page behind a CDN: a triage flowchart.
Reproduce, split client/edge/origin, then walk the branch. Twenty minutes to an owner, not a shrug.
How to warm a cache before a launch or sale day.
First users shouldn't pay the miss tax. Build the URL list, warm per POP, verify with headers.
How to prepare delivery for a traffic spike: the checklist.
Forecast, harden origin, pre-stage a degradation plan, warn the vendor, staff the war room.
How to reduce origin load: collapsing, keep-alive and shields.
Fewer fetches, cheaper fetches, gentler fetches — the three families between edge and origin.
How to speed up mobile delivery in emerging markets.
High RTT, lossy radio, data-priced users. Engineer for the far network, win everywhere.
How to switch on a WAF without breaking production.
Observe first, measure the false positives, carve the exceptions, then block in stages — the rollout order that never takes down a checkout.
How to tune WAF rules: killing false positives methodically.
Rank rules by friction, classify every match, scope the fix to path and parameter, and regression-test — the loop that ends WAF whack-a-mole.
How to set up rate limiting: budgets, thresholds, penalties.
Pick the counting key, set budgets from measured p99s — not guesses — and choose penalties that de-escalate. Plus the CGNAT trap that burns per-IP limits.
How to configure bot management: allow, block, challenge.
Three lanes — verified crawlers pass, hostile automation is blocked, the ambiguous middle gets challenged — and the allowlist that keeps Googlebot and your own app out of the crossfire.
How to protect your origin: IPs, headers and private connectivity.
Hiding the IP is step one, not the plan. The four-rung ladder: clean IP hygiene, edge allowlists, secret headers or mTLS, and private connectivity when stakes justify it.
How to implement signed URLs and signed cookies.
URLs for single objects, cookies for whole libraries; what belongs in the token, dual-key rotation that never locks users out, and the cache-key trap that shreds hit ratio.
How to set security headers at the edge: a copy-paste baseline.
One edge rule covers every response. The baseline five, the values that fit most sites, and the two headers — HSTS preload and CSP — that punish copy-paste without thought.
How to prepare for DDoS: the runbook to write before the attack.
Attacks are survived on a quiet Tuesday: contacts and escalation paths, pre-approved switches, traffic baselines, comms templates — written down before the first packet.
How to handle certificates on a CDN: issuance, renewal, automation.
Lifetimes collapse from 398 days to 200 now, 100 in 2027, 47 by 2029 — CDN-managed issuance, custom-cert automation, the origin side, and the monitoring that catches what slips.
How to do geo-blocking and access control at the edge properly.
A compliance and abuse-shaping tool, not a security boundary: what IP geolocation can and cannot promise, honest 403s vs quiet nulls, and the VPN question answered per use case.
How to audit your CDN security config: a quarterly checklist.
Security decays by drift, not drama. Ten checks in half a day: origin exposure, TLS floor, WAF exceptions, token and access hygiene, dangling DNS — run empirically, from outside.
How to respond when your CDN is the outage: an incident playbook.
Ride it out or route around it — the answer is decided before the incident: independent detection, an honest diagnosis tree, pre-priced options and the evidence the SLA claim needs.
How to keep security parity across multiple CDNs.
Attackers choose which edge to attack, so protection equals the weakest CDN. The parity matrix, portable-vs-native control decisions, token compatibility, and tests that catch drift.
How to set up live streaming delivery: from encoder to edge.
One chain from camera to player — and three cache classes with opposite rules. Manifests near-zero, segments long, init fragments forever: the settings that fan one origin out to a million viewers.
How to configure VOD delivery: packaging, tokens and TTLs.
Immutable segments, year-long TTLs, one CMAF copy instead of two, session-scoped tokens that never touch the cache key — VOD is the friendliest workload a CDN has, if you let it be.
How to cut video startup time: the first-frame checklist.
First frame = page + player + manifest chain + init + first segments, all sequential. Shorten the chain, start on the right rung, keep the head of every title hot — the checklist toward one second.
How to fight rebuffering: diagnosis and fixes in order.
The buffer drained faster than delivery refilled it — but where? Measure, localize by dimension, attribute to ladder, ABR, cache or peering, then fix in the order that usually wins.
How to set up low-latency HLS and DASH without regret.
Parts, preload hints and blocking playlist reloads take live from 20+ seconds to 2–5 — if packager, CDN and player all cooperate. What each must do, and when standard latency is the wiser buy.
How to protect video: tokens, DRM and watermarking, layered.
Tokens gate the door, DRM locks the file, watermarking names the leaker — three layers doing three different jobs, applied by content value, not by fear.
How to deliver game patches and big binaries on launch day.
Millions of clients, tens of gigabytes, minute zero. Warn the CDN in writing, pre-warm every chunk, range-split the payload, stagger the rollout — the launch-day playbook.
How to serve software updates: ranges, resumes and mirrors.
Immutable versioned paths, byte-range resumes, deltas for the bandwidth, staged percentage rollouts with a kill switch, and a second path for the bad day — update plumbing done right.
How to deliver podcasts and audio at scale.
MP3s behind a CDN — plus the traps: measurement prefixes stacking redirects, IAB range-counting rules, release-morning spikes, and RSS polled by every app on earth.
How to handle user-generated content delivery safely.
Every uploaded file is adversary-authored until proven otherwise: signed direct uploads, transcode-everything normalization, a separate cookieless domain, and takedown purges that verifiably land.
How to configure SSAI-friendly caching for ad-supported video.
Personalize the playlist, never the media: session manifests bypass cache, content and ad segments stay shared, tracking beacons live off the media path — SSAI without the delivery tax.
How to run delivery for a live event: capacity maths and rehearsal.
Concurrency × bitrate = the terabits you must book, not hope for. The worked capacity maths, provider bookings in writing, the dress rehearsal, and the war-room ladder for the night.
How to pick QoE metrics for video and wire them to alerts.
Four numbers tell the story: startup time, stall ratio, delivered quality, failure rate — measured at the player, cut by ASN/CDN/device, alerted on the cuts where trouble actually starts.
How to decide if you need multi-CDN: the honest scorecard.
It buys availability, reach and leverage; it costs engineering, parity and hit ratio — forever. Five scored questions that end the debate with a defensible yes, no, or not-yet.
How to design a multi-CDN architecture: the patterns compared.
Active-passive, weighted active-active, performance steering, client-side switching — four patterns, rising in power and demands. Choose by what must survive, not by what demos well.
How to set up DNS-based CDN steering, step by step.
Weighted CNAMEs, health checks that test what users need, TTLs low enough to act and high enough to survive — and the resolver realities that decide how fast steering really is.
How to keep configurations in sync across CDNs.
Two rule engines, one intended behaviour: express intent in code, translate per platform, push every change through one process, and let a cross-edge test suite — not memory — prove parity.
How to split traffic across CDNs: ratios, geos, workloads.
Three axes decide who serves what: ratios sized to commits and confidence, geographies assigned on measured evidence, workloads homed where each platform is strongest — reviewed on a calendar.
How to fail over between CDNs without dropping sessions.
The traffic moves in minutes; the craft is what survives the move: sessions independent of the edge, tokens and certs valid on both, the long-poll tail handled, the drill rehearsed.
How to run multi-CDN for video: mid-stream switching setup.
Segments make video uniquely switchable: retry-on-failure, standardized content steering, or full player-side selection — three tiers from insurance to per-segment optimization.
How to use zero-egress storage as a multi-CDN origin.
Two CDNs means twice the origin fetches — and cloud egress bills every byte. A neutral zero-egress store as the shared origin removes the tax; here is the setup and the fine print.
How to add edge compute without locking yourself in.
Every edge runtime is someone’s walled garden. Keep the logic thin, code to web-standard interfaces, treat vendor state as a cache, and keep a ledger of every tie you accept.
How to migrate between CDNs: the reverse cutover playbook.
Build the destination in shadow, prove it with the parity suite, move traffic in percentage waves with the return path open, and only then — deliberately — decommission the source.
How to test a CDN you’re not using yet: shadow traffic setups.
Evaluate with your traffic, not their brochure: log-driven replay, side-by-side response diffing, then a real dark-launch slice — three fidelities of shadow, run with provider etiquette.
How to manage certificates and DNS across a multi-CDN estate.
Every hostname, valid on every platform, on 200-day-and-shrinking lifetimes — plus a DNS layer promoted to control plane. The delegation patterns and monitoring that keep it boring.
How to steer on RUM data: closing the measurement loop.
Users measure, traffic follows: per-ASN-per-CDN scores from your own RUM, decision rules with damping and minimum samples, and guardrails that keep the control loop from oscillating.
How to read your CDN invoice: every line item decoded.
Regional tiers, request fees, feature add-ons, support percentages, overage — each line decoded, reconciled against your own logs, and checked for the drift that creeps in quietly.
How to forecast CDN spend: three methods that work.
Trend extrapolation for the base, driver-based modelling for the why, event build-up for the spikes — combined with error bands and refreshed monthly. Plus when each method lies.
How to size a commit: the maths of over- and under-committing.
Undercommit pays overage on the excess; overcommit pays for ghosts. The break-even maths across your forecast distribution, a worked example, and the terms that soften both tails.
How to cut your CDN bill this quarter: ten levers, ranked.
Configuration beats negotiation on speed: hit ratio, compression, image bytes, log diet, request count, regional mix, storage moves, feature audit, commit fit, split leverage — ranked by payback.
How to tag and allocate CDN spend to products.
A shared invoice is an unowned invoice. Map hostnames and paths to products, meter usage from logs, rate it into money, split the shared remainder by written rules — and publish it monthly.
How to set delivery SLOs: targets your team can defend.
Not the vendor’s SLA and not a wish: user-centric SLIs, targets derived from your own baseline, and error budgets that actually gate releases and spending decisions.
How to run a CDN vendor QBR: the agenda that gets results.
Take the meeting back: your scorecard opens, incidents arrive with asks attached, the commercial position is stated plainly, and every item leaves with an owner and a date.
How to claim SLA credits: evidence, process, expectations.
Credits are claimed, not granted: know the SLA’s measurement rules before the incident, capture independent evidence during it, file inside the deadline — and price the credit honestly.
How to document your delivery estate on one page.
Hostnames, providers, origins, DNS, certs, contacts, contract dates, runbook links — one page, in version control, linked from the incident channel, and kept true by habit, not heroics.
How to train your team on CDN operations: a 30-day plan.
Week one: concepts and the estate tour. Week two: logs, purge, dashboards hands-on. Week three: real changes, supervised. Week four: drills. Signed off against a checklist, not vibes.
How to plan CDN capacity for the year ahead.
The edge scales; your obligations don’t scale themselves. Seasonal curve, event calendar, regional growth, provider notification thresholds, and a written headroom policy — one page, reviewed quarterly.
How to run an annual delivery review: the full-estate audit.
The year, accounted for: traffic and spend vs forecast, SLO attainment, incident themes, security and vendor posture — compressed into next year’s decisions, owners attached.