A CDN looks simple from the outside — files feel closer — but the request path has three distinct jobs: receive, evaluate and deliver. Understanding those jobs is how you set TTLs, bypass rules and purge without surprises.
Receive: the client never aims at origin
Anycast and GeoDNS send the HTTPS request to a nearby point of presence and match it to a distribution. TLS 1.3, HTTP/3 or HTTP/2 and the certificate all terminate at the edge, not on the application VM.
That is why hiding the origin IP matters. If clients can still reach the origin directly, the CDN is optional and so is its protection.
Evaluate: cache policy decides the rest
The edge applies cache keys, TTLs, query-string behaviour, access policies and token authentication. A hit returns immediately. A miss may go through Origin Shield so duplicate fetches are collapsed.
Serve-stale can return an eligible expired object if the origin is down. That is a delivery decision, not an application retry loop.
Deliver: hits, misses and large files
Cached HTML, assets, images, video segments and installers leave the PoP. Large-file optimisation covers game patches and software downloads on the same 200+ Tbps network.
The origin should only see traffic that is unique, uncacheable or a true miss. An 85% average hit ratio is what that looks like when the content is actually reusable.
Change: purge, prefetch and deploys
A global cache is only useful if you can invalidate it. Purge by URL, file or directory when HTML, media or manifests change. Prefetch heroes or depots before a launch so the first users do not all miss together.
Hashed filenames skip purge. index.html and latest pointers do not. Put purge in CI.