Global Network and DDoS
Latency, availability and attack absorption for users who are far from your origin.
The first performance problem for an overseas business is rarely a slow server; it is users on the other side of the planet. These articles cover what cross-border paths are actually made of, what a CDN does and does not fix, why an exposed origin defeats every edge control, and which layer of DDoS is automatic versus which needs rules written in advance. They also answer a question that is usually asked the wrong way: if you are already on a cloud provider, do you still need a third-party edge.
What we conclude in this topic
- Cross-border round trips dominate latency; no CDN rescues personalised responses on its own.
- Hiding the origin is a prerequisite, not a bonus — a reachable origin IP means edge protection can be routed around.
- Network-layer attacks are handled automatically; slow application-layer floods need rules written beforehand.
- One cloud or several makes no difference to whether this layer helps.
- Delivery inside mainland China needs ICP licensing, started well before you need the performance.
All articles (7)
Network Architecture for AI Products Going Global: Model Calls, AI Gateway, and Edge Caching
AI latency is cross-border round trips plus inference, not rendering. Split edge access, AI Gateway and model layer; caching only hits identical requests.
DDoS Runbook for SaaS Teams: Prepare Before It Happens
Cloudflare mitigates L3-7 DDoS on every plan. A runbook is about the other half: six things to prepare, an order of response, and who decides what.
Can a CDN Protect Your Website from DDoS Attacks?
A CDN solves the DDoS problems that usually kill a site: origin exposure, concentrated traffic and repeated requests. Where it stops.
Cloudflare vs AWS, Alibaba Cloud and Tencent Cloud: Do You Need Both?
Your cloud decides where the app runs; Cloudflare decides how global users reach it. Real overlap, real pricing, DNS setup, when Enterprise fits.
How to Choose DDoS Protection for Global Businesses
DDoS protection is not bought by bandwidth. Three tests decide if a service protects you: coverage, preconditions, and where it stops working.
How to Mitigate HTTP Flood and Layer 7 Attacks
A layer 7 flood looks legitimate, so capacity never solves it, classification does. Four signals, the mitigation order and plan thresholds.
How Attackers Find Your Origin IP Behind Cloudflare
Proxied DNS hides your origin from a lookup, not from an attacker. Six leak paths, a verification order, and four containment layers.
Related Cloudflare capabilities
CDN
Caches and serves your content from a global edge network, cutting latency for distant users and removing load from your origin.
DDoS Protection
Always-on mitigation across L3, L4 and L7, absorbing volumetric attacks on the edge network instead of at your origin.
Magic Transit
Extends Cloudflare's network-layer DDoS protection to your own IP ranges, for services that are not HTTP.
China Network
Delivers your site from nodes inside mainland China through a licensed local partner, for businesses whose users are in China.
Frequently asked questions
Users are abroad and the origin is at home — is a CDN enough?
Enough for static assets, often not for APIs. A CDN does not help responses that vary per user; what improves is the network path — requests reach a nearby edge location instead of crossing continents, and connection reuse shortens the handshake. Measure time-to-first-byte and cache hit ratio before and after before judging the result.
Why is an exposed origin such a big deal?
Because attacks can simply route around the edge. When the domain is protected but the origin address is still reachable, a targeted attack skips the CDN and WAF entirely and hits the origin directly. The fix is to rotate the origin address, restrict who can reach it, or connect it through a tunnel so it is not on the public internet at all.
Does DDoS protection really need no preparation?
It depends on the layer. Network-layer attacks are automatic and always on — nothing to prepare. Application-layer attacks need rules and sensitivity levels configured beforehand, because a slow flood looks like ordinary traffic request by request. That difference is the whole point of preparing before an incident.
Other topics
- API and AI Security — Protecting the endpoints that actually cost money: contract validation, identity, quotas and automation control.
- Bots and Scraping — Separating automated traffic from real users, then deciding what to do with each.
- Selection and Procurement — Comparing options, checking capability boundaries, and buying Enterprise without guessing.