Features
Everything a delivery zone can do.
There are 171 settings on a delivery zone. Most sites need about six of them. This is the full list, grouped the way the platform groups it, so you can find the one you came for.
Caching
| Capability | What it does for you |
|---|---|
| Smart cache | Works out sensible cache lifetimes from your origin's headers, so a site with no cache configuration still gets cached properly. |
| Cache expiry override | Ignore what your origin says and set your own lifetime — useful when a CMS sends no-cache headers it should not. |
| Perma-cache | Keeps a permanent copy in storage so files never expire out of cache. Your origin is hit once, ever, instead of every time a location needs a fresh copy. |
| Cache slicing | Splits large files into chunks so a viewer seeking through a video does not pull the whole file. |
| Stale while revalidate | Serves the cached copy instantly while fetching a fresh one behind it, so nobody waits for your origin. |
| Cache key control | Decide whether query strings, cookies, headers, device type or country create separate cached copies. |
| Request coalescing | When a hundred people request an uncached file at once, your origin gets one request rather than a hundred. |
| Instant purge | Clear a whole zone, a cache tag, or one URL, and it takes effect everywhere in seconds. |
Security
| Capability | What it does for you |
|---|---|
| Managed firewall rules | A maintained rule set that blocks known attack patterns before they reach your site. On every zone at no charge. |
| Custom firewall rules | Your own conditions — block, challenge or allow based on path, header, country, IP or user agent. Part of Shield Premium. |
| Rate limiting | Cap how many requests one address can make in a window. Two limits free, ten with Premium. |
| DDoS mitigation | Volumetric attacks are absorbed at the edge rather than reaching your origin. |
| Country and IP blocking | Allow or deny by country or address list, without touching your application. |
| Referrer control | Stop other sites hotlinking your images and spending your bandwidth. |
| Token authentication | Signed, expiring URLs — so a link to a paid download cannot be shared indefinitely. |
| Origin shield | One location fetches from your origin and feeds the rest, so your server sees a fraction of the requests. |
Certificates and transport
| Capability | What it does for you |
|---|---|
| Free SSL, issued automatically | A certificate for every hostname you attach, renewed before it expires. Nothing to buy and nothing to remember. |
| Bring your own certificate | Upload your own if you have one, including wildcards and EV. |
| Force HTTPS | Redirect every plain request to HTTPS, per hostname. |
| TLS version control | Turn off older TLS versions when a compliance requirement says you must. |
| Origin certificate verification | The edge checks your origin's certificate rather than trusting whatever answers. |
Routing and geography
| Capability | What it does for you |
|---|---|
| Geographic zones | Choose which continents serve your traffic. Switch off regions you do not sell into and stop paying for them. |
| Latency routing | Visitors reach whichever location answers fastest for them, not merely the nearest on a map. |
| Origin failover | A second origin takes over if the first stops answering. |
| Traffic steering | Send a share of traffic to a different origin — useful for staged rollouts. |
| Follow redirects | The edge follows redirects at your origin rather than passing them to the visitor. |
Headers, cookies and CORS
| Capability | What it does for you |
|---|---|
| Custom request and response headers | Add, remove or rewrite headers in either direction without touching your application. |
| CORS headers | Set access control headers at the edge, including per-extension rules for fonts and media. |
| Cookie handling | Strip cookies entirely, or vary the cache on named cookies only. |
| Canonical header | Adds a canonical link header so search engines credit your own domain, not the delivery hostname. |
| Vary controls | Cache separately by device, country, hostname or AVIF support, only where you actually need it. |
Logging
| Capability | What it does for you |
|---|---|
| Access logs | Every request, retained and downloadable. |
| Extended logging | Adds detail that ordinary logs leave out, for when you are debugging rather than reporting. |
| Log forwarding | Stream logs to your own collector over syslog or HTTP as they happen. |
| IP anonymisation | Truncate or drop addresses in logs where privacy rules require it. |
Edge compute
| Capability | What it does for you |
|---|---|
| Edge rules | If this, then that — rewrite a URL, set a header, redirect, block or change caching, evaluated at the edge with no origin round trip. |
| Edge scripting | Run your own code at the edge, before or after the cache, for logic that rules cannot express. |
You do not have to understand all of this
A normal site turns on a delivery zone, points a hostname at it, and is finished. The rest of this list exists for the cases where the default is not right — and it is all in your dashboard when you need it rather than an upgrade away.
Start with a delivery zone
Create one in your dashboard and point it at your site. It takes about five minutes.