Contents
Getting started
10-minute quick startArchitecture
Install and upgrade
Install the controllerAdd nodesOnline upgradesStaged rollout and automatic rollbackBackup and point-in-time restoreUninstall and migrate
Sites
Add a siteSet up the CNAME recordHTTPS certificatesCache rulesPurge and prefetchOrigin settingsAlways Online, 0-RTT and 103 Early HintsTiered origin (L2)Stream forwarding (Layer 4)
Security
Security overview and big screenWebsite checkupAttack logCC protectionWAFLists and access controlBots and scannersJA4 / TLS fingerprintXDP kernel-level filteringPaid features
Analytics and alerts
StatisticsAccess logsAlerts and notificationsAlert channels
Accounts and licensing
Users and plansLicenses and add-onsOnline top-up and identity verification

Tiered origin (L2)

About 7 minApplies to v2.3.1Updated 2026-11-02

Tiered origin adds an L2 layer between edge nodes and your origin: on an edge miss, the edge asks L2 first, and only if L2 also misses does the request reach the origin. L2 fetches each piece of content once on behalf of many edges, so the origin sees far fewer requests and less concurrency. It is a licensed add-on.

One-click enable

Administrators open Node Management › L2 Tier and click "One-click enable tiered origin". The system picks recommended nodes as L2; it takes about 2 minutes and does not affect current traffic.

The same page then shows today's saved origin traffic and the L2 hit rate (origin requests served by L2 as a share of edge origin requests).

Advanced: L2 groups

Use L2 groups for finer control, split by region, carrier or URL rules. Allocation modes include "Closest to origin" and "Fixed by URL". If an L2 is unreachable the edge switches to another one, goes straight to the origin if none works, and switches back on recovery.

Per-site settings

In the site edit drawer under Origin Configuration › Tiered origin (L2), choose which L2 group the site uses (it follows the region default by default).

With "Origin Allows Only L2" switched on, the origin should accept only L2 node IPs. Until the origin allows a new L2 node, that node serves cacheable requests only.

Caution With "only L2" on, origin fetches fail if no L2 is available anywhere. Confirm the origin allows every L2 node IP before turning it on.

Plans and licensing

A plan option "includes tiered origin" decides which plans can use it. After the tiered-origin license lapses there is a fallback window; when it ends, sites go back to fetching from the origin directly, and the panel shows the fallback time and the number of affected sites.

For other origin settings see Origin settings, and for the overall design see Architecture.