Are a CDN and web hosting the same thing?

No. Hosting runs your application and stores the original data (the origin). A CDN sits in front of the origin and keeps copies of responses in many places. Many hosts include a CDN, but the two roles are different.

Does a CDN work for APIs and dynamic content?

Partly. Responses that differ per user should not be cached, but a CDN can still terminate TLS near the visitor, reuse connections to the origin and filter attacks. Public responses that are the same for everyone can be cached for a few seconds.

How do I clear the CDN cache after updating a file?

There are two ways: request a purge from the CDN, or change the file URL, for example with a hash in the name (app.3f9a1c.js). The second is more reliable because it does not depend on the purge reaching every server.

Does a CDN make a site more secure?

It helps in some ways: it absorbs traffic spikes, hides the origin address and often includes a WAF and DDoS mitigation. It does not fix bugs in your code, and a file loaded from a third-party CDN is a risk if that CDN is compromised.

What is a CDN and what is it used for?

If your server is in New York and your visitor is in Tokyo, every request crosses the planet twice: once out and once back. Light in fiber has a finite speed, so distance turns into waiting time. A page with 40 files pays that delay many times over.

A CDN attacks the problem by putting copies of your content close to the people who request it. The result is a faster site, a less stressed server and less damage when traffic suddenly spikes.

What is a CDN?#

CDN stands for Content Delivery Network. According to the MDN definition, it is a group of servers spread over many locations that store copies of data, so each request can be served by the server closest to the user.

Three terms come up all the time:

Origin: your own server, where the original content lives.
Point of presence (PoP): a physical CDN location in a data center, with several servers.
Edge: the CDN servers closest to the visitor.

The CDN acts as an intermediary: the visitor talks to it, and it only talks to the origin when it has to.

How does a CDN work?#

A request follows four steps:

The visitor requests https://www.example.com/logo.png. DNS returns an address belonging to the CDN, not your origin.
The request reaches the nearest PoP. Many CDNs use anycast: the same IP address is announced from many PoPs, and internet routing itself sends the visitor to the closest one.
If the PoP already holds a valid copy of the file, it answers immediately. This is a cache hit.
If not, it fetches the file from the origin, answers the visitor and stores the copy for the next ones. This is a cache miss.

Only the first visitor at each PoP pays the cost of going to the origin, until the copy expires. Later visitors get the stored copy. That is why the origin sees only a fraction of the requests, even when the site is busy.

What does a CDN cache?#

The best candidates are things that are identical for every visitor:

Static files: CSS, JavaScript, fonts, images, video and downloads.
Static pages: generated sites (ready-made HTML) can be served entirely from the CDN.
Public API responses: a product list that is the same for everyone can be cached for a few seconds.

What should not be cached: personalized responses, such as an authenticated user's dashboard or a shopping cart. If such a response were stored in a shared cache, another visitor could receive it.

How does the CDN know how long to keep a copy?#

Your origin decides, through the Cache-Control response header. The values that matter most for a CDN:

Directive	What it does
`max-age=3600`	The response is fresh for 3600 seconds, in any cache
`s-maxage=3600`	Same, but only for shared caches (such as a CDN), and it overrides `max-age` there
`public`	Allows storing even for requests with `Authorization`
`private`	Only the browser may store it; the CDN may not
`no-store`	Nobody stores it
`immutable`	The content never changes; do not revalidate
`stale-while-revalidate=300`	May serve the stale copy for up to 300 s while fetching a fresh one in the background

A practical setup: files with a hash in the name get a new URL whenever the content changes, so they can be stored for a year. HTML needs a short browser cache but can stay longer on the CDN.

For /assets/app.3f9a1c.js:

http

Cache-Control: public, max-age=31536000, immutable

For /index.html:

http

Cache-Control: public, max-age=0, s-maxage=300, stale-while-revalidate=60

Each directive is covered in what is Cache-Control. Shared cache semantics are defined in RFC 9111, and stale-while-revalidate in RFC 5861.

How can you tell if a response came from the cache?#

Request only the headers with curl and run the command twice:

bash

curl -sI https://www.example.com/assets/app.3f9a1c.js

Look for Age, which says how many seconds the copy has been stored. If it shows a value above zero, the response came from an intermediate cache. Age: 0, or no Age at all, does not prove it came from the origin. Many CDNs also send their own header saying HIT or MISS, but the name varies by provider (check yours). The first call is usually a MISS and the second a HIT.

When does a CDN not help?#

Personalized or real-time content: with no caching, every request still goes to the origin. The CDN may shorten the TLS handshake, but the distance to the origin remains.
Audience close to the origin: if every visitor is in the same city as the server, there is little latency to save.
Poorly configured cache: without a clear Cache-Control, each CDN applies its own defaults, and you may serve a stale file or never benefit from caching.
Third-party dependency: if you load libraries from a public CDN and it goes down or is blocked, your site breaks. If it is compromised, it can deliver malicious code. Use Subresource Integrity (the integrity attribute, with crossorigin="anonymous", on <script>) so the browser rejects a modified file.

CDN, load balancer and reverse proxy: what is the difference?#

All three sit between the visitor and your application, which is why they get mixed up. A load balancer spreads requests across several of your own servers. A CDN stores copies in many places around the world. In practice, a CDN is a distributed reverse proxy with a cache, and many also include load balancing, a WAF and DDoS protection.

How to do this on Square Cloud#

Every Square Cloud plan includes a global CDN, unlimited traffic (no charge per bandwidth or per request, under a fair-use policy), automatic TLS, a WAF and L3/L4/L7 DDoS protection. Your web application gets a *.squareweb.app subdomain with HTTPS and, from the Standard plan, you can use a custom domain.

The network is an Anycast CDN with more than 200 points of presence, HTTP/3 and WebSockets. It caches according to your application's Cache-Control, and cache purge works on both the squareweb.app subdomain and your own domain. To use your own domain, you create the DNS records shown in the dashboard at your registrar.

See the network details in Square Cloud network and CDN.