What is a CDN and how do I tell if I am behind one?
How to detect a CDN from response headers, and why it changes what an audit of your site is actually measuring.
A CDN serves your site from servers near each visitor. Detecting one takes a single curl -sI — most announce themselves in headers. It matters because a CDN can add, remove and rewrite your headers, so what you configure at the origin and what the public receives may be different things.
Spotting one
curl -sI https://example.com| Header | Indicates |
|---|---|
cf-ray, cf-cache-status | Cloudflare |
x-amz-cf-id, via: ... CloudFront | Amazon CloudFront |
x-vercel-id, x-vercel-cache | Vercel |
x-nf-request-id | Netlify |
x-fastly-request-id, x-served-by | Fastly |
x-akamai-*, akamai-* | Akamai |
x-cache: HIT / MISS | Some caching layer, vendor unspecified |
age: | A cached response, and how many seconds old it is |
DNS is the other tell — if your apex resolves to addresses belonging to a CDN rather than to your host, you are behind one whether or not you set it up deliberately. Several hosting platforms enable a CDN by default.
Why it changes what you are measuring
This is the part with practical consequences. A CDN sits between your server and everyone else, and it can modify what passes through.
- Headers you set may not arrive. An edge configuration can strip or override them. Your CSP is in your repository and absent from the response.
- Headers you did not set may appear. The CDN adds its own caching, security and identification headers.
- The certificate is usually theirs. You are inspecting the edge certificate, not your origin's.
- Responses may be cached. You can be measuring a version of your page from hours ago.
- Bot protection may intercept. Automated clients get challenges the browser never sees.
- Behaviour varies by region. Different edge nodes can hold different cached content or run different rules.
Comparing edge against origin
When a header is configured and not appearing, compare the two directly:
# What the public receives
curl -sI https://example.com | grep -i content-security-policy
# What your origin sends, bypassing DNS
curl -sI https://example.com --resolve example.com:443:ORIGIN_IP \
| grep -i content-security-policyA header present in the second and absent from the first means the edge is stripping it, and the fix belongs in the CDN configuration rather than in your application.
Checking your cache is working
curl -sI https://example.com/some-asset.css | grep -iE 'cache-status|x-cache|age|cache-control'A persistent MISS on static assets means the CDN is passing everything through to your origin and providing very little. Usually a Cache-Control problem: no-store, an absent max-age, or cookies on asset responses defeating caching entirely.
Worth knowing
- A CDN is not a security control. It adds DDoS absorption and a WAF if configured, and your application code remains exactly as exposed.
- Purge after deploy. Stale cached HTML is the most common post-deploy confusion, and it makes fixes appear not to have worked.
- Bot rules cut both ways. Rules aggressive enough to block auditors frequently block AI crawlers too. If AI visibility matters to you, check what your edge rules do to them.
What our audit reports about this
Every item below is measured directly, not inferred. Run it against your own site and the result names the exact rule or header responsible.
- CDN and edge detection from response headers, labelled as inferred rather than measured.
- Cache headers and cache status, so a CDN passing everything through is visible.
- All security headers measured on the served response, which is what visitors actually receive.
- Whether requests are being challenged or blocked at the edge, reported as undetermined with the reason.
For agents and scripts, the same measurement is at
/api/v1/infra?url=yoursite.com —
see the API documentation.
Related questions
Do I need a CDN?
For a site with a geographically spread audience, or heavy static assets, it helps meaningfully. For a small site serving one region from a decent host, the benefit is modest and the added configuration surface is real.
Why do my security headers not appear?
Most commonly the edge is stripping or overriding them. Compare the public response against your origin directly with curl --resolve — if the header is present at origin and absent publicly, the fix is in the CDN configuration.
Does a CDN affect SEO?
Positively if it makes the site faster, and negatively if it serves stale content or blocks crawlers. The risk worth checking is bot protection rules, which frequently block legitimate crawlers along with everything else.
Which certificate am I actually inspecting?
The edge certificate, since that is what terminates the connection. Your origin certificate is separate and generally not publicly reachable — which is fine, provided the origin connection is itself encrypted.
Read next
How do I tell if a website is down or just blocking me?
Distinguishing a real outage from bot protection, geoblocking or a network problem — and what each failure mode looks like.
ReadWhat HTTP headers should every website send?
A prioritised list of response headers, what each one prevents, and which are safe to add without testing.
ReadHow do I find out what a website is built with?
Identifying a site's stack from what it discloses — and understanding why disclosure is itself a finding.
ReadWhy did my website score change when I did not change anything?
The four causes of an unexplained score movement, and how to tell which one you are looking at in under a minute.
Read