Last month, on June 25, researchers warned that polyfill.io, a free service whose JavaScript was embedded in more than a hundred thousand websites, had started serving malicious code. The domain and its GitHub account had been sold in February to a company that began quietly redirecting some mobile visitors to scam and betting sites. Every site that loaded a script from it was serving that code to its own users. Namecheap suspended the domain the next day, and Cloudflare and Fastly stood up clean mirrors and began rewriting links to point at them.
Polyfill.io wasn't a CDN company in the usual sense, but it worked like one, and it's a good place to start. A content delivery network makes your website faster and more resilient by putting someone else's servers in front of it. That's an enormous benefit, and it means trusting someone else with every byte your users receive.
What a CDN does
Your server lives in one place. Your users don't. A CDN runs servers, called points of presence, in hundreds of cities, and routes each user to a nearby one. Then it does several jobs at once:
- Caching. Static files like images, scripts and stylesheets, and sometimes whole pages, are kept at the edge and served from there. The trip to your server is skipped, and your server sees a fraction of the traffic.
- TLS termination. The encrypted connection is set up at the nearby edge, which shaves noticeable time off every new connection.
- Absorbing attacks. A DDoS attack meant to flood your server lands on a network built to absorb hundreds of times more traffic than you'll ever see.
- Filtering. A web application firewall at the edge can block common attacks and abusive bots before they reach you.
- Running code. Most now let you run small programs at the edge, for redirects, authentication or entire applications.
The major players
Cloudflare has the biggest footprint by number of websites, since a large share of the web runs through it, partly because its free plan is generous. DNS, CDN, DDoS protection, WAF and a large edge-computing platform in Workers come in one dashboard, with sensible defaults. It's the easiest place to start. It's also very opinionated, and some of its features rewrite your pages on the way through: email address obfuscation, script optimization and injected analytics. Know which ones you've turned on.
Akamai is the original. It was founded in 1998 out of MIT research and still runs one of the largest distributed networks in the world, embedded deep inside ISPs. It's the incumbent for large media delivery, banking and big enterprises, with security products to match. Its tooling is more enterprise and its prices are negotiated. In 2022 it bought Linode to add general cloud computing, which I wrote about in Akamai and Linode.
Amazon CloudFront is AWS's CDN. Its advantage is integration: if your origin is S3 or an AWS load balancer, setup is straightforward, permissions run through AWS identity, and data transfer from AWS to CloudFront is free. Outside AWS, it's a perfectly good CDN with AWS's pricing complexity.
Fastly is the developer's CDN, built on a modified Varnish cache. It's known for very fast configuration changes and near-instant purging, which is why news and media sites with constantly changing pages like it, plus a serious WebAssembly edge platform. Its June 2021 outage, when one customer's configuration change triggered a latent bug that took down a large part of its network, including major news sites and government services, for most of an hour, is a lesson in what concentration means.
Imperva is security first: WAF, DDoS mitigation, bot management, API security and data protection, with CDN capabilities alongside. It was bought by Thales last year. Its customers tend to be regulated industries where the security features are the point.
Sucuri, owned by GoDaddy, is aimed at small sites, particularly WordPress. Its firewall and CDN come bundled with malware scanning and cleanup. It's a reasonable choice for a site owner who wants someone else to handle security without becoming an expert.
The trade-offs nobody puts on the pricing page
- They see everything. With TLS terminated at the edge, the CDN decrypts every request and response, including passwords and personal data, on its way through. That's how the caching and filtering work. Choose accordingly, and read the data processing terms.
- Your origin must be locked down. If attackers can find your server's real IP address, they can bypass the CDN and its protections entirely. Accept traffic only from the CDN's address ranges, use authenticated origin pulls, or connect through a tunnel so the origin has no public listener.
- Cache mistakes are public. Cache a personalized page by accident and the next visitor sees someone else's account. Be explicit about what's cacheable.
- Concentration. A large share of the web depends on a handful of networks. When one has a bad day, a big piece of the internet has a bad day with it.
- Third-party scripts aren't your CDN. Polyfill.io is the warning here. Loading JavaScript from someone else's domain means trusting whoever owns that domain next year. Host your own copies, or use Subresource Integrity hashes so the browser rejects a file that changes.
Choosing
- A personal site, small business or blog: Cloudflare's free plan is hard to beat. Sucuri if you want hands-on security help for WordPress.
- Everything already in AWS: CloudFront.
- Media, news or a site that changes constantly: Fastly or Cloudflare.
- A large enterprise, global media delivery or a regulated industry: Akamai or Imperva, with a contract and an account team.
Whatever you choose, verify what users actually receive by comparing it with what your server sends, test what happens when the CDN is unreachable, and keep your DNS somewhere you can change quickly.
Since then
Added October 2026. The concentration risk made headlines again on November 18, 2025, when a bad configuration file took down a large part of Cloudflare's network for about three hours, and with it sites and services from social networks to AI chatbots. It wasn't an attack. It was one oversized file pushed everywhere at once.