Home / Knowledge hub / Edge security
Knowledge hub
Edge security
Protections placed at the network edge, such as CDN rules and bot filtering.
What it means
The edge is the layer between the internet and your application, usually run by a content delivery network or a similar provider. Requests reach it first, from servers spread around the world, and only then pass on to your own servers.
Edge security is what you do at that layer: filtering bad traffic, absorbing floods, terminating TLS, caching pages, blocking known bots, applying a WAF and setting rate limits. The aim is to stop trouble before it reaches the app. Think of it as the outer wall.
Why it matters
The edge is a cheap and fast place to deal with common problems. A flood of requests can be soaked up there instead of taking your site down, which helps with denial of service. Bots that scrape or test stolen passwords can be slowed before they reach the login page.
It also gives a false sense of safety if relied on alone. Edge rules cannot know whether one customer is allowed to see another's invoice, and an attacker who reaches your servers directly skips the edge altogether. It is a useful outer layer, not a substitute for a safe application.
How it shows up
You meet it as CDN settings, WAF rules, bot management, DDoS protection, and rules that redirect or block by country, address or behaviour. Features like caching also live here, and a caching mistake can serve one user's private page to another.
Common gaps are an origin server that still answers to the whole internet instead of only the edge, rules in monitor mode that never block, caching of pages that vary by user, and rules that miss API paths. Lock the origin to the edge provider's addresses or a shared secret, and test through and around the edge.
Questions people ask
Edge security, answered
Is the edge the same as a WAF?
A WAF is one tool that often runs at the edge. Edge security is wider: it includes caching, DDoS protection, bot filtering, rate limits and encryption at the boundary.
A WAF is one part of that set.
Can attackers go around the edge?
Yes, if your servers accept traffic from anywhere. If an attacker learns the real address of the origin, they can send requests straight to it. Restrict the origin to the edge provider.
This is a common oversight.
What is cache deception?
It is a trick where a private page is stored by the cache under a URL that looks public, so another visitor receives it. It comes from caching rules that disagree with the app about what is private.
Cache only what is the same for everyone.
Do edge bot rules stop credential stuffing?
They slow it and block the obvious scripts. Determined attackers rotate addresses and imitate browsers, so you still need rate limits, multi-factor authentication and breached-password checks in the app.
Layer the defences.
How do we test our edge setup?
Try to reach your origin directly, compare results with and without the edge, and check which paths and methods its rules cover. Test that private pages are never cached.
Include API routes in the checks.
Sources
Where this comes from
Related
Terms that sit next to this one
WAF
A filter in front of your application that blocks known bad requests.
Denial of service
Making an application unavailable by overwhelming or exhausting it.
Bot traffic
Automated visitors that scrape, stuff credentials or buy stock before real customers.
Credential stuffing
Trying passwords leaked elsewhere, because people reuse them.
Rate limiting
Capping how often something can be attempted, per user or per address.
What gets through the edge?
We test the application behind the edge, including paths and requests that the rules were not written for, and show the request and response. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.