Origin shield
A shared cache between all the edge locations and your real server, turning many worldwide misses into one origin fetch.
See it
What it is
An origin shield is an extra cache layer between the CDN's edge locations and your origin. When London, Mumbai, and Sydney all miss the same object, they ask the shield first. With request collapsing, the shield makes one origin fetch, keeps the copy, and answers the other edges from it.
Reach for it when a global audience, a purge, or many short-lived edge entries create more origin traffic than the origin can comfortably handle. Every big CDN sells this under its own name: Amazon CloudFront calls it Origin Shield, Fastly calls it shielding, Cloudflare's related product is Tiered Cache. Choose a shield location with a fast, reliable path to the origin, which usually means the region the origin already lives in.
Gotcha: the shield adds another hop on a true miss. Put it far from the origin, or send uncacheable requests through it, and you add latency without reducing work. It also does not rescue a response marked private or no-store, and it cannot protect an origin that remains directly reachable around the CDN.
Ask AI for it
Enable Fastly shielding on the backend that serves this site. Select the Fastly shield PoP with the lowest measured latency to the origin, route all edge cache misses through it, and keep pass and private responses out of cache. Preserve stale content with stale-while-revalidate, enable request collapsing for concurrent misses, and lock the origin firewall to Fastly's published IP ranges. Report shield hits, shield misses, and origin fetches before and after the change.