Getting started
How an Orbit account is organised, what lives where in the console, and the shortest path from signing in to serving a name from our network.
Shield: cache, rules, TLS
What the edge does with a request.
Requests arrive at the node nearest the visitor, pass a fixed sequence of gates, and are answered from cache or fetched from your origin. This page is that sequence, in order.
01
The order of things
- Force HTTPS, if switched on — a 301 before anything else, so no gate ever runs on a plaintext page.
- Network rules — your own allow, block, challenge and rate-limit rules, by country, ASN, address or network operator.
- WAF, if switched on — pattern checks on the request, including its body where it is a form, JSON, text, XML or GraphQL under 64 KB.
- Rate limit — a token bucket per visitor address.
- Cache — served from the node's disk if a fresh copy is there.
- Origin — otherwise fetched from your origin, or through your Link tunnel.
A network rule whose action is ratelimit forces this request's allowance down to at most 30 per minute, whatever the site's own limit is. That is how a rule narrows a specific population without lowering the limit for everybody.
02
What gets cached
Your origin decides first. A response carrying no-store, no-cache or private is not cached at all, and one carrying max-age=N is cached for exactly N seconds. The site's own setting only applies where the origin said nothing.
| Mode | Caches |
|---|---|
static | Only static content types. Everything else goes to the origin every time. |
all | Everything, with an optional separate TTL for text/html. |
origin | Nothing, unless the origin asks for it with max-age. |
Purging is either the whole site, which takes one publish to reach the nodes, or a list of exact URLs — up to 30 at a time. There is no prefix or tag purge.
Each node keeps its own cache, and
Vary is not honoured. If a response differs by request header — language, encoding, device — either serve it from a distinct URL or keep it out of cache.03
Certificates
Issued automatically over the DNS challenge and renewed without you doing anything, as long as the DNS arrangement that let us issue is still in place. For a CNAME-connected hostname that arrangement is the _acme-challenge record — the single most common cause of a certificate quietly failing to renew months later.
04
Questions
Can I see what was blocked?
Yes. The site's Logs tab shows recent requests with the action taken — pass, waf, netrule_block, ratelimit, challenge or an origin error — so a rule that is too broad shows up as the thing it is catching.
Does the WAF inspect uploads?
No. Multipart, binary and oversized bodies are forwarded unexamined. Scanning a large upload at the edge would cost more than it protects; validate uploads at your origin.
Next
Related
DNS hosting
Add a zone, point your registrar at our name servers, and manage records. Includes weighted answers, health-checked records, ALIAS at the apex and zone-file import.
Connect a hostname
Delegate the whole domain, delegate one hostname, or add a CNAME and leave your DNS where it is. What each one costs you and when to pick it.