Contents
Getting started
10-minute quick startArchitecture
Install and upgrade
Install the controllerAdd nodesOnline upgradesStaged rollout and automatic rollbackBackup and point-in-time restoreUninstall and migrate
Sites
Add a siteSet up the CNAME recordHTTPS certificatesCache rulesPurge and prefetchOrigin settingsAlways Online, 0-RTT and 103 Early HintsTiered origin (L2)Stream forwarding (Layer 4)
Security
Security overview and big screenWebsite checkupAttack logCC protectionWAFLists and access controlBots and scannersJA4 / TLS fingerprintXDP kernel-level filteringPaid features
Analytics and alerts
StatisticsAccess logsAlerts and notificationsAlert channels
Accounts and licensing
Users and plansLicenses and add-onsOnline top-up and identity verification

Always Online, 0-RTT and 103 Early Hints

About 6 minApplies to v2.3.1Updated 2026-11-02

All three are per-site switches in the site edit drawer, opened from Site Management › All Sites (My Sites for tenants).

Always Online

Where: Origin Configuration › Connections & Fault Tolerance.

When the origin cannot be reached, the node answers visitors with a stale cached copy instead of an error. "Cannot be reached" means: DNS failure, connection refused, connect timeout, TLS handshake failure, or no response headers within the origin timeout.

  • If the origin itself returns 5xx or 429, that response is passed through; it is not replaced by a stale copy.
  • It applies only to GET / HEAD requests for pages that were cached before.
  • Stale copies are purged after 7 days without access.
  • It is off by default. The default for new sites is set under Global Settings › Default Settings.
Tip It suits read-mostly sites such as content and documentation. Don't rely on it for dynamic APIs or pages that need live data.

0-RTT

Where: Basic Configuration › HTTPS.

0-RTT uses TLS 1.3 early data so returning visitors send their request together with the handshake, saving one round trip. It is on by default for new HTTPS sites.

  • The node lets only GET / HEAD early data through; other methods get 425 and the client retries after the handshake.
  • Requests forwarded to the origin carry the Early-Data: 1 header so the origin can recognize them.
Caution If the origin has GET requests with side effects (for example placing or deducting an order via GET), early data can be replayed. Turn 0-RTT off, or have the origin check the Early-Data header and refuse.

103 Early Hints

Where: Advanced Configuration › 103 Early Hints.

When on, the node sends a 103 response ahead of the final response, telling the browser which resources to preload so styles and scripts start loading early. Enter the addresses in Preload links, or only pass through the 103 hints the origin sends.

Tip Preload only the critical resources the first screen certainly needs; too many links waste bandwidth.

For other HTTPS settings see HTTPS certificates, and for origin behaviour see Origin settings.