Turning on origin shield without melting your origin

Turning on origin shield without melting your origin

A news site in São Paulo had 19 edge POPs each hammering one Frankfurt origin during a traffic spike. Concurrent origin connections hit 2,400 and the database timed out.

We rolled out origin shield as a designated mid-tier, in order:

— Picked the shield POP closest to origin (not closest to readers) to cut the long hop
— Enabled it on static assets only for week one, watched origin connection count
— Confirmed shield-to-origin used keep-alive, not fresh TLS per request
— Verified the shield itself cached MISSes so 19 POPs collapsed into 1 fetch
— Then extended to HTML with a 30s micro-cache

Origin concurrent connections fell from 2,400 to 180. The shield absorbed the fan-out. Lesson: enable on static first — if you shield dynamic HTML day one and the micro-cache is wrong, you cache a logged-in user's page for everyone.

The number that mattered: 92% fewer origin connections at peak.