Protecting the Master Source
Consider what happens when a major live event starts — a product launch, a sports final, a breaking news story. Millions of users simultaneously request the same content. If that content isn't cached yet at CDN POPs worldwide (because it's brand new), every one of those thousands of POPs will simultaneously send a request to your origin server to fetch it. This is called the thundering herd problem, and it can instantly overwhelm even well-provisioned origin infrastructure.
To prevent this, CDNs introduce an Origin Shield — an additional caching layer that sits between the edge POPs and your origin server.
The request flow with Origin Shield:
- A user in Sydney requests a new video file. The Sydney POP has a cache miss.
- Instead of going directly to the origin in Virginia, the Sydney POP forwards the request to the designated Origin Shield (e.g., a POP in Singapore).
- The Singapore Origin Shield also has a cache miss, so it makes a single request to the origin in Virginia.
- Meanwhile, POPs in Melbourne, Auckland, and Jakarta also have cache misses for the same file. They all ask the Singapore Origin Shield.
- The Origin Shield receives the file from Virginia once, caches it, and serves it to all four requesting POPs.
- The origin server in Virginia received exactly one request instead of four (or four thousand).
The Origin Shield collapses what could be thousands of simultaneous origin requests into a single request, regardless of how many edge POPs are involved.
Trade-off: Origin Shield adds one extra network hop to cache-miss requests, slightly increasing latency for the very first request to a new piece of content. For cache hits (the vast majority of requests in production), there is no additional latency — the edge POP serves directly from its local cache.
Key Point: Origin Shield prevents origin server overload during traffic spikes by acting as a shared cache layer between edge POPs and the origin, reducing origin requests from O(POPs) to O(1) per unique piece of content.