Edge network security

What is edge network security?#

Edge network security means enforcing protection at the outer boundary of a network (the distributed nodes closest to users) rather than waiting for traffic to reach a central server or data centre. Threats like DDoS floods, bot traffic, and protocol-level attacks are identified and filtered at the edge, so only legitimate requests travel onward to your origin infrastructure.

The logic is simple: every request has to pass through the edge anyway, so the edge is the earliest point at which to inspect it, and therefore the cheapest and safest. The further an attack travels into your infrastructure before being stopped, the more damage and cost it causes along the way.

DDoS absorption at the edge#

A distributed denial-of-service attack works by overwhelming a target with more traffic than it can handle. Against a single server or even a single data centre, volume wins: the pipe fills up and legitimate users are locked out alongside the attackers.

A distributed network inverts that maths. Attack traffic enters the network at many different nodes, because each attacking machine is routed to its nearest entry point. No single location bears the full load. Each node filters the malicious share of what it receives, and the attack is absorbed across the network’s aggregate capacity rather than concentrated on your origin. This is why Edge includes DDoS protection with CDN and DNS at no extra cost: the architecture does most of the work.

Bot mitigation#

Not all hostile traffic is a flood. Credential stuffing, card testing, scraping, spam signups, and inventory hoarding are carried out by bots that look, individually, like ordinary requests. Stopping them requires telling humans and automation apart, ideally without forcing real users through puzzles.

Edge Shield does this with invisible verification: a lightweight proof-of-work runs in a background thread while risk signals are scored, and your server receives a 1–100 humanity score with every check. You decide what to do at each threshold (allow, step up or block), and repeat offenders face exponentially harder challenges that make abuse expensive to sustain. It’s free, uses no cookies or tracking, and works as a drop-in replacement for CAPTCHA. Our guides on protecting APIs from bots and securing login and signup flows cover the practical setup.

Encryption everywhere#

Edge security also means making encryption the default, not an option. On Edge, all traffic is encrypted in transit with TLS 1.3 and HTTPS is enforced across all endpoints. CDN domains get certificates issued and renewed automatically, so there is no window where a misconfigured or expired certificate leaves traffic exposed. Data stored on the network is encrypted at rest with AES-256.

DNS deserves particular attention, because it is the step attackers subvert to redirect users wholesale. Edge DNS supports DNSSEC signing to protect zones against spoofing and cache poisoning. See Is DNS centralised or decentralised? for more on DNS resilience.

The layers of edge security#

Effective edge protection combines several defences, each stopping a different class of threat before it reaches your origin.

• DDoS absorption: attack traffic is filtered at the nearest node, spread across the whole network instead of funnelled at your origin.
• Bot mitigation: Edge Shield verifies humans invisibly and scores every visitor 1–100, stopping automated abuse before it reaches your application.
• TLS everywhere: TLS 1.3 in transit, HTTPS enforced across all endpoints, and automatic certificates on every CDN domain.
• Distributed architecture: thousands of independent nodes leave no central chokepoint for attackers to target. The network itself is the defence.

How a distributed network shrinks the attack surface#

It might seem that thousands of nodes mean thousands of things to attack. In practice the opposite is true, because what matters is not the number of machines but the impact of compromising or disabling any one of them. In a centralised architecture, a successful attack on the core facility affects everyone. In a distributed edge network, a compromised or failed node is simply routed around, and encryption in transit and at rest means no individual node holds readable data worth stealing.

There is also no single origin IP for attackers to discover and target directly: your infrastructure sits behind the network, which presents the same hardened, distributed face everywhere in the world. Combined with platform controls such as role-based access, multi-factor authentication and continuous monitoring (detailed on our security page), the edge becomes a shield in depth rather than a wall with one gate.

For hardening the resources you run on Edge itself, see the security hardening guide.

Protect your applications at the edge#

DDoS protection included with CDN and DNS, and free bot protection with Edge Shield.