akamai.com Paid content Multilingual

A CDN (content delivery network) is a globally distributed group of servers that caches and serves your website's content from locations close to each user. It speeds up load times, reduces load on your origin server, cuts bandwidth costs, and absorbs some attack traffic. You need one when visitors are geographically spread out, your origin struggles under traffic, or you want a layer of protection and performance without rebuilding your application. Akamai, for example, describes itself as a cybersecurity and cloud computing company that delivers and protects content online — a useful reminder that modern CDNs are usually bundled with security and edge compute, not sold as caching alone.

How a CDN actually works

The mechanism is straightforward:

1. You point your domain at the CDN — usually by changing DNS records or adding a CNAME so requests resolve to the CDN's edge network instead of directly to your origin.
2. A user requests a file (an image, script, page, or video segment).
3. The nearest edge server answers. If it already has a valid cached copy, it returns it immediately — a cache hit.
4. On a miss, the edge fetches from your origin, stores a copy according to your caching rules, and serves it to the user.
5. Subsequent users near that edge get the cached copy, so your origin is hit far less often.

The distance between user and server is the core idea: physics limits how fast data travels, so serving from a nearby edge is faster than serving everything from one origin region.

What it does for your website

The DDoS point deserves a caveat: a CDN absorbs and distributes traffic, but full protection usually comes from a dedicated security layer (see below), not caching alone.

CDN vs. cloud computing, WAF, and edge platforms

These terms overlap and are often sold together, so it helps to separate them:

• CDN — caches and delivers content from edge locations. Its job is speed and offload.
• Cloud computing — provides compute, storage, and services in centralized (or regional) data centers. It runs your application; a CDN sits in front of it.
• WAF (web application firewall) — inspects HTTP traffic and blocks attacks like SQL injection or cross-site scripting. Many CDNs include a WAF, but the functions are distinct.
• Edge platform — runs code (serverless functions, logic) at the edge, closer to users than a central cloud region. It extends the CDN from serving content to processing requests.

A single vendor may offer all four. When comparing providers, check which capabilities are included versus added on.

How to put your site behind a CDN

1. Choose a provider based on where your users are, what's included (security, edge compute), and pricing for your regions. Akamai publishes region-specific pricing pages (North America, Europe, Asia Pacific, South America, Jakarta), so you can compare costs by geography rather than assume one global rate.
2. Add your domain in the provider's dashboard and verify ownership.
3. Change DNS or add a CNAME so traffic routes through the CDN. This is the step that actually puts you "behind" it.
4. Configure caching rules — set what's cached, for how long (TTL), and what must always hit the origin (e.g., logged-in pages, checkout).
5. Set up SSL/TLS so HTTPS works end to end.
6. Test with your browser's network tools or a command-line check to confirm content is served from edge locations and headers show cache hits.

Common problems and what to check

• Stale content — your TTL is too long or you haven't purged the cache after a deploy. Shorten TTLs for frequently updated assets and purge on release.
• Cache misses — caching rules may exclude the content, or query strings and cookies may be fragmenting the cache. Review what varies the cache key.
• SSL errors — certificate mismatch between edge and origin, or an incomplete chain. Verify both legs of the connection.
• Wrong content for logged-in users — personalized pages should bypass the cache; caching them can leak one user's data to another.

Deciding whether you need one

You likely benefit if your audience is geographically distributed, your origin is a bottleneck, or you want performance and protection without re-architecting. A single-region site with a local audience may see less gain. Before committing, confirm what's bundled (security, edge compute), how pricing varies by region, and whether the provider's edge locations actually cover where your users are — that coverage, more than any feature list, determines the real-world benefit.

Cloud computing is the delivery of computing resources — servers, storage, networking, databases, and software — over the internet on a pay-as-you-go or subscription basis, rather than through hardware you own and run yourself. It fits almost any organization that needs to scale capacity up or down, reach users in many locations, or avoid large upfront infrastructure spending. The harder question is not what cloud computing is but which service and deployment model and which provider fit your workload. This guide walks through the models, the core building blocks, and the selection criteria that actually drive the decision.

The three core service models

The most common way to categorize cloud services is by how much of the stack the provider manages versus how much you manage.

A concrete example: if you rent a virtual machine and install your own database on it, that's IaaS. If you push code to a managed runtime that handles patching and scaling for you, that's PaaS. If you simply log into a web-based CRM and use it, that's SaaS. The trade-off is consistent — the higher up the stack you go, the less control you have and the less operational work you carry.

Deployment models and when each fits

Service model and deployment model are separate questions. The deployment model describes who the infrastructure serves and where it sits.

• Public cloud — shared infrastructure operated by a provider and offered to many customers. Best when you want elasticity, broad geographic reach, and no capital expenditure.
• Private cloud — infrastructure dedicated to a single organization, either on-premises or hosted. Fits strict control, regulatory, or data-residency requirements.
• Hybrid cloud — a mix of public and private, connected so workloads can move between them. Common when some data must stay on-premises while other workloads benefit from public scale.
• Multi-cloud — using two or more public providers. Chosen to avoid lock-in, meet regional requirements, or use best-of-breed services from different vendors.

These are not mutually exclusive. Many organizations run a hybrid model across two public providers, which is both hybrid and multi-cloud.

Core building blocks to understand

Whatever the model, most cloud platforms expose the same fundamental primitives. Knowing these helps you compare providers on equal terms.

• Compute — virtual machines, containers, and serverless functions. The choice affects how much you manage and how you pay (per-second, per-request, or reserved).
• Storage — object storage for unstructured data, block storage for disks, and file storage for shared filesystems. Each has different durability, latency, and cost characteristics.
• Networking — virtual networks, load balancers, and private connectivity between your environment and the provider.
• CDN and edge delivery — a content delivery network caches content close to users to cut latency. Akamai, for instance, positions itself as both a cloud computing and security company that also operates a large CDN, which matters if your workload is latency-sensitive or globally distributed.

Selection criteria that drive the decision

Provider choice usually comes down to a handful of factors. Weigh them against your specific workload rather than in the abstract.

• Pricing model — understand whether you pay for reserved capacity, on-demand usage, or egress (data leaving the provider). Egress fees are a frequent surprise. Akamai publishes regional pricing pages (North America, Europe, Asia Pacific, São Paulo, and Jakarta), so you can compare rates by region rather than assume a single global price.
• Security — look at the provider's native security services, encryption options, and identity controls. For some buyers, security and cloud are a single evaluation.
• Compliance and data residency — confirm the provider can meet the regulations and geographic restrictions that apply to your data.
• Latency and reach — if users are spread across regions, edge and CDN coverage directly affects performance.
• Lock-in and portability — proprietary services can be convenient but harder to move. Multi-cloud or open standards reduce this risk at the cost of added complexity.

Common migration steps and pitfalls

A typical migration follows a recognizable sequence:

1. Assess — inventory workloads and classify them by dependency, sensitivity, and how easily they move.
2. Choose a model — decide IaaS, PaaS, or SaaS, and public, private, hybrid, or multi-cloud, per workload rather than for the whole estate at once.
3. Pilot — move a low-risk workload first to validate networking, security, and cost assumptions.
4. Migrate and optimize — move in waves, then right-size instances and storage to control spend.

Pitfalls to watch for: underestimating egress and data-transfer costs, assuming a lift-and-shift will automatically be cheaper, and skipping the pilot so that integration problems surface only in production. Treat pricing and compliance as things to verify against the provider's own published pages, since rates and terms vary by region and change over time.

Security on a CDN and edge platform means filtering and absorbing malicious traffic at edge nodes before it reaches your origin server. Instead of only hardening the origin, you distribute protection across a global network so attacks are mitigated closer to their source. This matters most when your site faces volumetric attacks, application-layer exploits, or automated abuse, and when you want to avoid exposing your origin IP directly. Tencent EdgeOne, for example, positions security alongside acceleration, serverless, and video delivery as a core edge capability.

The core security layers

A CDN/edge platform typically bundles several distinct protections. They address different threats and are often enabled independently.

These layers are complementary. DDoS mitigation keeps your service online under flood; WAF blocks exploit attempts that slip past volume-based defenses; bot management handles low-and-slow abuse that looks like normal traffic; TLS protects data in transit.

How edge-based security differs from origin-only protection

With origin-only protection, every request reaches your server before it is evaluated. Your origin absorbs the full attack volume, and its IP is often discoverable.

With edge-based security, requests terminate at an edge node first. The edge:

• Filters or challenges suspicious requests before forwarding.
• Absorbs volumetric attacks across many nodes rather than one server.
• Hides the origin IP when configured correctly, so attackers cannot target it directly.

The practical difference: origin-only defenses fail when the attack exceeds origin capacity. Edge defenses scale with the network, so capacity is less of a bottleneck. The trade-off is that you must route traffic through the edge consistently — if your origin IP leaks or is reachable directly, attackers can bypass the edge entirely.

Which protection addresses which threat

• Volumetric DDoS: needs DDoS mitigation with enough edge capacity to absorb the flood. Origin-only rate limiting usually fails here because the pipe itself saturates.
• Application exploits (injection, XSS): needs WAF rules. These attacks are small in volume, so DDoS mitigation alone will not stop them.
• Credential stuffing and scraping: needs bot management. These requests often look legitimate at the network level, so volume-based defenses miss them.
• Data interception: needs TLS end-to-end. Terminating TLS only at the edge without re-encrypting to origin leaves the edge-to-origin leg exposed.

A site can need all four, or only some. A static marketing site with no login may only need DDoS mitigation and TLS. An e-commerce site with accounts and checkout needs all four.

Practical steps to evaluate and enable security on a CDN/edge platform

1. Inventory your exposure. List public endpoints, login flows, APIs, and any user input. This tells you which layers are relevant.
2. Confirm origin IP is not directly reachable. If it is, edge security is bypassable. Restrict origin to accept traffic only from edge nodes.
3. Enable TLS end-to-end. Configure certificates at the edge and verify the edge-to-origin leg is encrypted, not plaintext.
4. Turn on DDoS mitigation. Usually always-on; verify the platform's capacity and whether it auto-scales.
5. Deploy WAF in monitor mode first. Log what would be blocked before enforcing, to avoid breaking legitimate traffic.
6. Add bot management where accounts or content value exist. Start with detection, then move to challenge/block.
7. Test with a controlled request. Send a known-malicious pattern (e.g., a test SQLi string) and confirm it is blocked. Send normal traffic and confirm it passes.

Common misconfigurations and how to verify

• Origin IP exposed. Verify by resolving your domain and checking whether the origin responds directly. If it does, lock it down.
• WAF in monitor-only mode left on. Check logs for blocked vs. logged events; if nothing is ever blocked, enforcement may be off.
• TLS terminated at edge but plaintext to origin. Inspect the edge-to-origin connection; if it is HTTP, data is exposed internally.
• Bot rules too aggressive. Watch for legitimate users getting challenged; tune thresholds against real traffic.
• DDoS protection untested. Run a controlled load test within allowed limits to confirm mitigation engages.

Verification is the same for each layer: send a request that should be blocked and confirm it is, then send a request that should pass and confirm it is not blocked. If both behave as expected, the layer is working.

Choosing what matters for your site

Match protections to your actual risk rather than enabling everything by default. A brochure site needs TLS and DDoS mitigation. A site with logins and payments needs WAF and bot management too. The decision hinges on whether you have user input, accounts, or valuable content — those are the conditions that make WAF and bot management worth the configuration effort. EdgeOne bundles these capabilities with its CDN and edge platform, so the evaluation question becomes which layers your site actually requires, not whether the platform offers them.