A cache you cannot invalidate is a liability. A purge that invalidates everything is an origin incident you scheduled. Purge the path that changed, prefetch what you know will be hot, and keep hashed assets out of the ritual.
URL, file, directory
Cloud CDN can purge by URL, file or directory. Use the narrowest scope. A product image is a URL. A theme release may be a directory. A whole-distribution wipe is a last resort.
Hook it to publish and deploy
CI should purge HTML and any unhashed paths after a production deploy. CMS webhooks should purge the node, product or landing-page URL that changed — not the entire site on every draft save.
Prefetch is the opposite operation
Before a launch, prefetch heroes, depots or HTML so the first users do not all miss together. Shield still helps; warm cache helps more.
Confirm with logs
After purge, the next request should miss once, then hit. If origin traffic does not move, you purged the wrong key (query string, trailing slash, encoded path).