Origin shield
An origin shield is an extra caching layer that sits between a CDN's edge servers and the origin server, so that edges ask the shield for content instead of the origin. Many edge requests for the same segment are combined into one request to the origin. This protects the origin from overload and lowers data transfer costs.
Why it matters
Without a shield, a popular new video or live event can send thousands of identical requests to the origin at once, causing slowdowns or outages. An origin shield protects the origin, raises the share of requests served from cache and reduces origin egress costs. It is a small addition with large effects on reliability.
How it works
- The CDN designates one caching layer, the shield, close to the origin.
- Edge servers that miss in their cache ask the shield instead of the origin.
- The shield combines identical requests and fetches each segment from the origin once.
- It stores the segment and serves every edge that asks for it afterwards.
Do I need an origin shield?
You likely need an origin shield if you run live events, release popular content or use many CDN locations. In those cases, many edges ask for the same new files at once. A shield turns those requests into one. For small libraries with steady traffic, a shield adds cost without much benefit.
Origin shield vs edge cache: what is the difference?
An edge cache sits near viewers and serves them directly, while an origin shield sits near the origin and serves the edge caches. The edge reduces delay for viewers. The shield reduces load on the origin. Together they form a two-layer cache, so most requests never reach the origin.
Where it's used
Live sports streamers and OTT services add an origin shield to protect their main servers when thousands of edge servers ask for the same new video at once.
By the numbers
- Amazon CloudFront states that requests for content not in Origin Shield's cache are consolidated, resulting in as few as one request going to the origin. (Amazon CloudFront: Use Origin Shield)
