After a content purge, your origin receives 400× normal traffic and falls over. The CDN is working as configured. What is missing and how do you fix it?

What is happening

A global CDN has hundreds of points of presence, each with an independent cache. A purge invalidates the object everywhere at once, so the next request at each PoP is a miss, and each miss generates its own origin fetch.

The CDN produced its own thundering herd. Nothing is misbehaving.

The fix

Origin shield — an intermediate parent cache between the edge and the origin. Edge misses go to the shield; only the shield's misses reach the origin. Hundreds of concurrent fetches collapse to one.

Configure the shield near the origin, and accept the cost: one extra hop on edge misses.

Request coalescing at each layer, so simultaneous misses for the same object result in one upstream fetch rather than N. Most CDNs support this and it is often not enabled.

Stop purging where you can

Content-hashed filenames with max-age of a year and immutable. A new version is a new URL, so there is nothing to invalidate — the strongest form of this fix, because the failure mode is removed rather than mitigated.

stale-while-revalidate for content that must stay at a stable URL: the edge serves the stale response immediately and refreshes in the background. Users never wait for a refresh, and the origin sees a trickle rather than a wall.

stale-if-error so the edge keeps serving when the origin is down — turning an origin outage into stale content rather than an outage.

Cache-Control precision, since this is where it comes from

no-cache means revalidate before use, not "do not store" — that is no-store. s-maxage applies to shared caches only, so the CDN can hold something longer than the browser. private is mandatory on personalised responses; getting it wrong serves one user's data to another, which is the most serious caching bug there is.

What a strong answer adds

Treating the origin as something that must survive a complete cache loss — a full purge, a CDN failover, a cold region. If it cannot, the CDN is not an optimisation but a load-bearing dependency, and capacity planning must say so.