RESOURCES
CDN and WAF stress testing
Measure what the edge absorbs versus what reaches origin — on properties you are authorized to test.
Edge vs origin
A strong cache-hit homepage can hide a fragile origin path. Run distinct scenarios: cacheable GETs versus uncacheable writes, and watch CDN challenge rates, origin 5xx, and pool saturation in parallel with Hub live metrics.
Coordinate with your CDN/WAF vendor when the window is large. Abort if challenge storms or origin errors exceed the pre-agreed budget — capacity theater that takes production down is a failed rehearsal.
Deep dive: Stress testing behind Cloudflare CDN. Related: website capacity, concurrent vs RPS.
Hypothesis checklist
- Which POP / region shape matches real users?
- Which paths must bypass cache on purpose?
- What challenge or block rate is acceptable before abort?
- Who watches origin dashboards during the run?
Frame the whole program with authorized load testing and the 2026 checklist.
Next steps
All use cases · Features · Pricing · How it works · Start free
Edge pitfalls that fake green results
CDN and WAF tests mislead when cacheable assets absorb almost all Hub traffic while the origin never sees conversion load. Challenged requests can also look like “the edge held” when legitimate sessions are actually blocked. Another miss is testing only one PoP or one region — anycast and DNS steering change which edge node answers.
Separate hypotheses: edge absorption, WAF false positives on real cookies, and origin survival when cache misses. Pair this page with website capacity testing and the Cloudflare-oriented notes on the blog.
Run sequence for edge vs origin clarity
- Verify the hostname and notify CDN/WAF admins of the window and expected challenge behavior.
- Smoke a cacheable path; confirm edge metrics move and origin stays quiet if that is the design.
- Force or choose a cache-miss / dynamic path and watch origin latency and errors.
- Raise concurrents in steps; abort if challenge rates or origin budgets breach the plan.
- Cool down and confirm ruleset rollbacks if legitimate users were affected.
Method choice: Layer 7 for HTTP journeys; Layer 4 when the pipe or scrubbing path is the question. Size capacity on pricing.
Metrics unique to CDN / WAF stacks
- Cache hit ratio and origin request rate (they should tell one story).
- WAF challenge / block rate on authenticated and checkout cookies.
- Edge vs origin p95 latency split.
- Regional differences when multi-region generators are enabled.
Hub tip: label scenarios “edge-cache” vs “origin-dynamic” so reports do not blend two cliffs into one number. Policy and verification culture: authorized load testing. Pre-flight reachability tools: useful network tools.
When not to run an edge stress window
Do not rehearse on a CDN property you do not control, and do not treat WAF tuning as a reason to bypass authorization. If the only question is application-handler CPU on a hostname without a CDN, a direct API or origin L7 test is cleaner. Avoid production edge tests during provider maintenance or while rulesets are mid-edit.
Register for a trial on verified targets, then use Hub stop controls the moment abort criteria fire. Glossary anchors: glossary · developer notes: docs.
Related
Resources hub · Glossary · Tools matrix · RPS calculator · Useful network tools · Blog · Pricing · Start free