Start with the request
A content delivery network (CDN) serves eligible content from locations closer to visitors and forwards other requests to the origin. A web application firewall (WAF) evaluates HTTP requests against security rules. A provider can offer both at the same edge, but a cached response and a blocked attack are different outcomes.
For example, an image can be served from cache while an administrator login request is inspected and forwarded. The WAF does not make every application secure, and caching a page is not a substitute for access control.
Compare the responsibilities
| Question | CDN | WAF |
|---|---|---|
| Main job | Deliver and cache eligible content | Inspect and filter HTTP requests |
| Useful evidence | Cache status, origin requests, latency | Rule ID, action, request path, false positives |
| Key risk | A private response cached for another visitor | A legitimate request blocked by an overly broad rule |
Actual feature sets vary by provider and configuration. DDoS protection, bot controls, TLS and rate limiting may be separate services or plans; check the terms for the chosen product.
A safe rollout
Inventory public assets, login, checkout and API routes. Start cache rules with clearly public files, respect origin cache headers and test as both an anonymous visitor and a signed-in user. Never assume a URL is public just because it loads without a password in one browser.
For the WAF, review available managed rules in a logging or non-blocking mode where supported. Compare events with application logs before changing to blocking. When an exception is necessary, scope it to the narrowest verified route and rule, record an owner and review date, and test a representative legitimate request.
Verify the origin too
Confirm that the application validates identities and authorizes each sensitive operation. Restrict direct origin access according to your network design without accidentally blocking health checks or legitimate administration. Monitor origin traffic and WAF events after rollout; an edge rule is only one part of the request path.
Further reading
Read the official documentation. For help applying these checks, explore Clouvenix services.