Shield: cache, rules, TLS

What the edge does with a request.

Requests arrive at the node nearest the visitor, pass a fixed sequence of gates, and are answered from cache or fetched from your origin. This page is that sequence, in order.

01

The order of things

  1. Force HTTPS, if switched on — a 301 before anything else, so no gate ever runs on a plaintext page.
  2. Network rules — your own allow, block, challenge and rate-limit rules, by country, ASN, address or network operator.
  3. WAF, if switched on — pattern checks on the request, including its body where it is a form, JSON, text, XML or GraphQL under 64 KB.
  4. Rate limit — a token bucket per visitor address.
  5. Cache — served from the node's disk if a fresh copy is there.
  6. Origin — otherwise fetched from your origin, or through your Link tunnel.
A network rule whose action is ratelimit forces this request's allowance down to at most 30 per minute, whatever the site's own limit is. That is how a rule narrows a specific population without lowering the limit for everybody.
The order of the gatesA request passes six gates in a fixed order: force HTTPS, your network rules, the WAF, the rate limit, the cache, and only then your origin or your tunnel.RequestForce HTTPS1Network rules2WAF3Rate limit4Cache5Origin, or your tunnel6only with no fresh copy
Six gates, always in this order. A request stops at the first one that refuses it, and reaches your origin only when the cache has nothing fresh to serve.
02

What gets cached

Cache at the edgeThree requests reach the nearest location. The first has nothing to serve and is fetched from the origin once; the ones after it are answered from the cache and never reach the origin.First requestLater requestLater requestmisshithitNearest locationwith a cache on its own diskYour originfetched once,then served from cache
One request fills the cache and the ones after it are answered from it. Which requests do that is decided by the rules below, with your origin's own headers taking precedence.

Your origin decides first. A response carrying no-store, no-cache or private is not cached at all, and one carrying max-age=N is cached for exactly N seconds. The site's own setting only applies where the origin said nothing.

ModeCaches
staticOnly static content types. Everything else goes to the origin every time.
allEverything, with an optional separate TTL for text/html.
originNothing, unless the origin asks for it with max-age.

Purging is either the whole site, which takes one publish to reach the nodes, or a list of exact URLs — up to 30 at a time. There is no prefix or tag purge.

Each node keeps its own cache, and Vary is not honoured. If a response differs by request header — language, encoding, device — either serve it from a distinct URL or keep it out of cache.
03

Certificates

Issued automatically over the DNS challenge and renewed without you doing anything, as long as the DNS arrangement that let us issue is still in place. For a CNAME-connected hostname that arrangement is the _acme-challenge record — the single most common cause of a certificate quietly failing to renew months later.

04

Platform plan allowance

AllowanceFreePro
Hostnames2040
Transfer a month500 GB1,000 GB
Security rules100200

Allowances are per account. Pro is switched on by request: open a ticket at the Help Centre. Usage is in the console. All platform plans

05

Questions

Can I see what was blocked?

Yes. The site's Logs tab shows recent requests with the action taken — pass, waf, netrule_block, ratelimit, challenge or an origin error — so a rule that is too broad shows up as the thing it is catching.

Does the WAF inspect uploads?

No. Multipart, binary and oversized bodies are forwarded unexamined. Scanning a large upload at the edge would cost more than it protects; validate uploads at your origin.

Next

Related

Getting started

How an Orbit account is organised, what lives where in the console, and the shortest path from signing in to serving a name from our network.

DNS hosting

Add a zone, point your registrar at our name servers, manage records: weighted answers, health-checked records, ALIAS at the apex, zone-file import.

Connect a hostname

Delegate the whole domain, delegate one hostname, or add a CNAME and leave your DNS where it is. What each one costs you and when to pick it.

← All documentation