Features

Set cache rules per site; purge and prefetch so updates take effect promptly.

Origin fetches are shared within a region; about half the origin requests in our tests

Both HTTP/2 and HTTP/3 are supported and switched on per site.

Spread origin requests across several origins and fail over automatically when one goes down.

HTTPS certificates are issued and renewed automatically; nothing to do before expiry.

Certificates are swapped by hot update, with no node restart. No failures were seen during swaps in our tests.

Detects and limits abnormal high-rate access to protect your origin and bandwidth.

A built-in WAF blocks common web attacks; switch it on per site and choose the action.

Standard/strict protection levels, live attack screen, semantic detection, deep bot analysis, anti-tamper, leak prevention, and upload scanning with trojan signatures, antivirus and a sha256 blocklist

Continuously updated vulnerability-patch and emergency rules, bot lists and a high-risk IP library, synced hourly

Allow or block by IP or range, globally or per site.

Allow or block by visitor region. A free geolocation database is built in; the commercial edition has more accurate province and carrier data, updated faster.

Bandwidth, requests and hit ratio in real time, with downloadable access logs.

Attack trends, blocked traffic and attack records in one place, plus a site health check.

Automatic alerts and notifications when something goes wrong.

Manage regions, line groups and nodes together; config is pushed to every node automatically.

Run one command on any Linux server to turn it into a CDN node that registers with the controller.

Config rolls out in stages (1 node, 10%, all) and can be rolled back; node package upgrades can be staged and hot-swap without dropping connections (from 2.1.3).

Sites are isolated per user; admins manage users, plans and quotas in one place.