--- title: "Fastly Origin Shield: How Shielding Works and What It Costs" description: How Fastly shielding works, choosing a shield POP, effect on origin load and cache hit ratio, and what origin shield adds to your bill. image: https://blog.blazingcdn.com/hubfs/Gemini-Blog/image-Oct-15-2026-07-00-57-7561-AM.jpeg --- [![BlazingCDN](https://blog.blazingcdn.com/hubfs/Logo/blog-logo-w.png)](https://blog.blazingcdn.com?hsLang=en-us) [๐Ÿ“˜Learn โ–พ](https://blog.blazingcdn.com/cdn-learn?hsLang=en-us) [CDN Fundamentals](https://blog.blazingcdn.com/cdn-fundamentals?hsLang=en-us) [By Content Type](https://blog.blazingcdn.com/by-content-type?hsLang=en-us) [Advanced Concepts](https://blog.blazingcdn.com/advanced-concepts?hsLang=en-us) [Glossary](https://blog.blazingcdn.com/glossary?hsLang=en-us) [โšก Web Performance](https://blog.blazingcdn.com/web-performance?hsLang=en-us) [๐ŸŽฌVideo & Streaming โ–พ](https://blog.blazingcdn.com/video-streaming-cdn?hsLang=en-us) [๐Ÿ”ด Live Streaming](https://blog.blazingcdn.com/live-streaming?hsLang=en-us) [๐Ÿ“บ VOD & OTT](https://blog.blazingcdn.com/vod-ott?hsLang=en-us) [๐Ÿ’ฐ Bandwidth & Costs](https://blog.blazingcdn.com/bandwidth-costs?hsLang=en-us) [๐Ÿญ Other Industries โ–พ](https://blog.blazingcdn.com/cdn-industry-insights?hsLang=en-us) [๐Ÿ“บ Media & Broadcasting](https://blog.blazingcdn.com/media-broadcasting?hsLang=en-us) [๐Ÿ’พ Software & SaaS](https://blog.blazingcdn.com/software-saas?hsLang=en-us) [๐Ÿ—๏ธ DevOps & Cloud Infra](https://blog.blazingcdn.com/devops-cloud-infra?hsLang=en-us) [๐Ÿ“š AdTech & Advertising](https://blog.blazingcdn.com/adtech-advertising?hsLang=en-us) [๐ŸŽฎ Gaming & Esports](https://blog.blazingcdn.com/gaming-esports?hsLang=en-us) [๐Ÿ“ฑ Mobile Apps & Developers](https://blog.blazingcdn.com/mobile-apps-developers?hsLang=en-us) [๐Ÿค– AI & Machine Learning](https://blog.blazingcdn.com/ai-machine-learning?hsLang=en-us) [๐Ÿ›๏ธ Enterprise & Corporate](https://blog.blazingcdn.com/enterprise-corporate?hsLang=en-us) [๐Ÿ“š E-Learning & EdTech](https://blog.blazingcdn.com/e-learning-edtech?hsLang=en-us) [๐ŸŸ๏ธ Sports & Live Events](https://blog.blazingcdn.com/sports-live-events?hsLang=en-us) [๐Ÿ’ฐ Pricing & Costs โ–พ](https://blog.blazingcdn.com/cdn-pricing-and-cdn-costs?hsLang=en-us) [Provider Pricing](https://blog.blazingcdn.com/provider-pricing?hsLang=en-us) [Cost Optimization](https://blog.blazingcdn.com/cost-optimization?hsLang=en-us) [Decision Support](https://blog.blazingcdn.com/decision-support?hsLang=en-us) [โšกCompare โ–พ](https://blog.blazingcdn.com/cdn-comparison?hsLang=en-us) [Provider Comparisons](https://blog.blazingcdn.com/provider-comparisons?hsLang=en-us) [Strategy Comparisons](https://blog.blazingcdn.com/strategy-comparisons?hsLang=en-us) [Ratings & Benchmarks](https://blog.blazingcdn.com/cdn-ratings-and-benchmarks?hsLang=en-us) [๐Ÿ“Š Benchmarks](https://blog.blazingcdn.com/cdn-ratings-and-benchmarks?hsLang=en-us) [๐Ÿ”’ Security โ–พ](https://blog.blazingcdn.com/cdn-security?hsLang=en-us) [Attack Protection](https://blog.blazingcdn.com/attack-protection?hsLang=en-us) [Encryption & Access](https://blog.blazingcdn.com/encryption-access?hsLang=en-us) [Video & DRM Security](https://blog.blazingcdn.com/video-drm-security?hsLang=en-us) [๐Ÿ“ Case Studies](https://blog.blazingcdn.com/case-studies?hsLang=en-us) [๐Ÿ”Œ Integrations](https://blog.blazingcdn.com/integrations?hsLang=en-us) [๐Ÿ› ๏ธ Tools](https://blog.blazingcdn.com/cdn-tools?hsLang=en-us) [Get Started](https://blazingcdn.com/sign-up-contact-form/) [Learn](https://blog.blazingcdn.com/en-us/tag/learn) [Pricing - Pricing & Costs](https://blog.blazingcdn.com/en-us/tag/pricing-pricing-costs) [Pricing - Provider Pricing](https://blog.blazingcdn.com/en-us/tag/pricing-provider-pricing) [Learn - CDN Fundamentals](https://blog.blazingcdn.com/en-us/tag/learn-cdn-fundamentals) [Compare - Provider Comparisons](https://blog.blazingcdn.com/en-us/tag/compare-provider-comparisons) # Fastly Origin Shield: How Shielding Works and What It Costs Vadym Borovskyi Oct 15, 2026, 9:04:12โ€ฏAM ![](https://blog.blazingcdn.com/hubfs/Gemini-Blog/image-Oct-15-2026-07-00-57-7561-AM.jpeg) Fastly origin shield has no separate line item on a Fastly invoice as of 2026. A shielded cache miss is billed as an extra request plus extra bandwidth between the edge POP and the shield POP, so an uncacheable 1 MB response generates roughly 2 MB of Fastly-billed transfer before your cloud provider adds origin egress. This article explains how Fastly shielding routes a miss and how to pick the shield POP. It also includes before-and-after origin request math, a break-even formula with threshold values, and how tiered caching is billed at four other CDNs. Shielding pays for itself on egress alone only when the shield hit ratio exceeds your effective Fastly per-GB rate divided by your origin egress per-GB rate. With a $0.02 per GB Fastly contract rate and $0.05 per GB cloud egress, the break-even shield hit ratio is 40%. Below that line you are paying for origin protection, not savings. ## **How Fastly shielding works on a cache miss** Without shielding, every Fastly POP that misses fetches from your origin independently. An object that is popular in 30 POPs is pulled up to 30 times per TTL window. With shielding enabled, you designate one shield POP per backend. Every other POP forwards its misses to that POP instead of to the origin, so the origin sees one fetch per object per TTL window, regardless of how many POPs requested it. The request path for a miss at both tiers is edge โ†’ shield โ†’ origin โ†’ shield โ†’ edge. The edge node marks the forwarded request with the Fastly-FF header. At the shield, request collapsing merges concurrent misses for the same cache key into a single origin fetch. Clustering already deduplicates fetches across nodes inside one POP, and shielding extends that deduplication across POPs. Users close to the shield POP get a single hop, because their edge is the shield. When the shield returns an object, the edge reads the Age header and caches it for the remaining TTL, so both tiers expire together. For vendor-neutral background on cache hierarchies, see the [**CDN fundamentals hub**](https://blog.blazingcdn.com/cdn-fundamentals?hsLang=en-us). ### Why your VCL runs twice under shielding Any request that crosses both tiers executes vcl\_recv on the edge node and again on the shield node. Logic that is not idempotent breaks quietly. A path prefix gets added twice, a query parameter is appended twice, or an origin auth header is computed from already-rewritten input. Geolocation also changes meaning. At the shield, client.geo describes the edge node rather than the user, so geo-based routing must be captured at the edge into a request header. The usual guards are to run edge-only logic when fastly.ff.visits\_this\_service equals zero, and to run origin-only logic (signing, host rewrites) only when req.backend.is\_origin is true. Pass-through traffic still takes the two-hop path, which is why APIs and personalized responses are the first candidates for bypassing the shield. ## **Choosing a Fastly shield POP** Choose the Fastly shield POP with the lowest round-trip time to your origin, which in practice means the POP in the same metro as your cloud region: an Ashburn-area POP for an origin in us-east-1, or a Frankfurt-area POP for eu-central-1. A shield more than a few milliseconds from the origin adds that latency to every shield miss. - **One shield per backend.** Multi-region origins need one backend per region, each with its own shield, or else the shield sits far from at least one origin. - **Measure the candidates.** Route a canary backend through each candidate shield and compare origin first-byte time in your Fastly logs. A shield that is 5 ms from the origin and one that is 40 ms away differ by 35 ms on every shield miss. - **Weigh where traffic lands.** Users near the shield POP skip a hop. When the origin metro is ambiguous, prefer the candidate closer to your largest audience. - **Plan for shield loss.** Fastly documentation describes edges falling back to direct origin fetches when a shield is unhealthy. Size origin capacity for that unshielded miss rate, not for the shielded one. ## **Before and after: origin request math** The worked example below uses stated assumptions, not measurements: 2 billion requests and 50 TB delivered per month, an 85% edge hit ratio, a uniform object size, and an 80% shield hit ratio once shielding is on. | Metric (per month) | No shield | Shield at 80% hit | | --- | --- | --- | | Origin requests | 300 million | 60 million | | Origin egress | 7.5 TB | 1.5 TB | | Total origin offload | 85% | 97% | | Extra Fastly-billed requests | 0 | 300 million | | Extra Fastly-billed transfer | 0 | 7.5 TB | Shielding cuts origin load fivefold in this model, but every edge miss becomes a billable Fastly request and transfer whether the shield hits or not. The fan-out view is just as useful for capacity planning. Take one object requested in 30 POPs with a 10-minute TTL. Without a shield it can cost 30 origin fetches every 10 minutes, or 4,320 a day. With a shield it costs 144 a day. That 30x ratio is what protects an origin during a release or a cache purge. ## **What Fastly origin shield costs: pricing notes for 2026** Fastly origin shield pricing has no fixed fee in 2026. The cost is indirect: per Fastly documentation, each edge-to-shield hop counts as an additional request, and the shield-to-edge response counts as additional bandwidth at your contracted rate. Origin egress drops in exchange. Whether the net is positive depends on two per-GB rates and your shield hit ratio. Fastly's published rate card reaches about 20 TB, where a month costs $2,087 (published price lists, checked August 2026). Above that, effective rates are quote-based and vary widely by commitment. Check with your account team whether shield-to-origin fetches are metered on your contract. Hyperscaler internet egress list prices for the first tiers typically run $0.05 to $0.09 per GB as of 2026. ### Break-even shield hit ratio by rate | Effective Fastly rate | Origin egress $0.05/GB | Origin egress $0.09/GB | | --- | --- | --- | | $0.01/GB | 20% | 11% | | $0.02/GB | 40% | 22% | | $0.04/GB | 80% | 44% | | $0.08/GB | Never on egress alone | 89% | The higher your effective Fastly rate relative to origin egress, the higher the shield hit ratio needed before shielding saves money rather than only protecting the origin. Request fees move the threshold further. Apply the earlier model at $0.02 and $0.05 per GB. The origin egress saved is 6,000 GB times $0.05, or $300, and the added transfer is 7,500 GB times $0.02, or $150. That leaves $150 net. If the contract also charges an illustrative $0.0075 per 10,000 requests, the 300 million extra requests add $225, and the month ends $75 worse off. In that case shielding pays only through the origin compute and capacity it avoids, which is often the larger number anyway. ### Origin shield pricing at other CDNs | Vendor | Shield tier cost | Billing model | Limitation to know | | --- | --- | --- | --- | | Fastly | No separate fee | Shield hops billed as requests and bandwidth | VCL runs on both tiers; misses are billed twice | | BlazingCDN | Included on every plan | Per-TB tiers, no request fees | Delivery layer only: no HTTP/3, WebSockets or WAF | | Amazon CloudFront | Roughly $0.0075 to $0.016 per 10,000 shield requests (estimate, recent list prices) | Per-request Origin Shield charge | One shield region per origin | | Cloudflare | Smart Tiered Cache at no extra charge | Part of plan pricing | Custom topologies require Enterprise | | bunny.net | Optional per pull zone | Per-GB delivery pricing | Short list of shield locations | Fastly and Amazon CloudFront make you pay per shielded miss in some form, while the others fold the tier into delivery pricing. As of October 2026, BlazingCDN includes origin shield and request coalescing on every plan and bills from $5 per TB down to $2.50 per TB at volume, with one rate for US, Europe and Asia and no request fees. The 50 TB month in the model above costs $215, against $2,087 for 20 TB on Fastly's published rate card, and the [**BlazingCDN vs Fastly comparison**](https://blazingcdn.com/vs/fastly/) covers the feature differences. Below about 46 TB a month, flat plans such as Amazon CloudFront Business ($200 for 50 TB) or Cloudflare Pro ($25) can cost less. ## **When Fastly shielding costs more: failure modes** | What breaks | How it shows up | How to confirm | | --- | --- | --- | | Frequent purges | Shield hit ratio collapses after each deploy | Overlay purge timestamps on origin request rate | | High-cardinality cache keys | Shield hit ratio stuck below 30% | Count distinct keys per URL from Vary, cookies and query strings in logs | | Live manifests, short TTLs | Objects expire before a second POP asks | Compare TTL with median inter-request gap per object | | Distant shield POP | p95 miss latency rises after enabling | Shield-to-origin first-byte time in logs | | Double VCL execution | Malformed origin URLs, wrong geo routing | Origin access logs filtered on the Fastly-FF header | | Shield POP unhealthy | Sudden fan-out surge at origin | Origin requests lacking a shield hop spike together | Most shielding regressions show up first in the origin access log, not in Fastly dashboards, so instrument the origin before you enable the shield. ### Verify this on your own stack Request a cacheable object twice from two regions and read the response headers. Under shielding, X-Served-By lists two cache nodes, and X-Cache shows two values, edge state then shield state, such as MISS then HIT. At the origin, every request should carry the Fastly-FF header. A rising share of requests without it means the shield is being bypassed. ## **Should you enable Fastly shielding per service?** Measure each service for seven days before deciding. Track edge misses, shield hit ratio, origin fetch volume, request counts and bandwidth, then plug your contracted rates into the break-even table. Static assets, image libraries, VOD segments and software downloads with long TTLs usually clear the threshold. Authenticated APIs, personalized HTML and live manifests usually do not, and they belong on a bypass rule. The cheapest gain usually comes before shielding. Normalize cache keys, extend practical TTLs, and batch purges. Each raises both edge and shield hit ratios, and shielding only multiplies what the cache key design already allows. ## **FAQ: Fastly origin shield and shielding costs** ### Does Fastly charge extra for origin shield? Fastly does not charge a separate fee for origin shield as of 2026. The cost appears inside existing charges: an edge-to-shield hop counts as an additional request, and the shield-to-edge response counts as additional bandwidth. An uncached 1 MB response therefore produces about 2 MB of Fastly-billed transfer. Confirm on your contract whether shield-to-origin fetches are metered separately. ### How do I choose a Fastly shield POP? Pick the Fastly shield POP with the lowest round-trip time to your origin, usually the POP in the same metro as your cloud region. Each backend gets one shield, so multi-region origins need separate backends. Validate candidates by comparing shield-to-origin first-byte time in your logs, and size the origin for the unshielded miss rate in case the shield fails. ### What shield hit ratio makes Fastly shielding worth it? Fastly shielding saves money on egress when the shield hit ratio exceeds your Fastly per-GB rate divided by your origin egress per-GB rate. At $0.02 and $0.05 per GB, that threshold is 40%. Request fees push it higher. Below the threshold, shielding can still be worth enabling for origin protection during purges, releases and traffic spikes. ### How does origin shield pricing differ between Fastly and Amazon CloudFront? Amazon CloudFront charges an explicit per-request fee for Origin Shield, roughly $0.0075 to $0.016 per 10,000 requests depending on region, based on recent list prices. Fastly has no shield line item but bills each shielded miss as an extra request and extra bandwidth. Both models cost the most on workloads with many cache misses. ### Should Fastly shielding be used for APIs and live streaming? Fastly shielding usually adds cost and latency for authenticated APIs, personalized responses and live manifests. These requests pass through both tiers without being reused, so every response is billed twice and gains an extra hop. Bypass the shield for those paths and keep it for long-TTL static content, VOD segments and large downloads, where shield hit ratios stay high. ## **Price your shielded traffic before changing the config** This week, export seven days of edge miss bytes, request counts and shield hit ratio per Fastly service. Divide your effective Fastly per-GB rate by your origin egress rate, compare the result with each service's shield hit ratio, and list the services that fall below the line. Those services are the ones to fix with cache key cleanup or to move to a bypass rule. Origin access logs filtered on the Fastly-FF header will show whether the change worked. If the heavy, cacheable part of that traffic is video, downloads or images, the [**BlazingCDN cost calculator**](https://blazingcdn.com/cdn-cost-calculator/) prices the same monthly volume on progressive tiers from $5 per TB, with origin shield included. Share: [f](https://www.facebook.com/sharer/sharer.php?u=https://blog.blazingcdn.com/en-us/understanding-fastlys-origin-shield-and-its-cost-implications) [in](https://www.linkedin.com/sharing/share-offsite/?url=https://blog.blazingcdn.com/en-us/understanding-fastlys-origin-shield-and-its-cost-implications) [๐•](https://twitter.com/intent/tweet?url=https://blog.blazingcdn.com/en-us/understanding-fastlys-origin-shield-and-its-cost-implications&text=) [โœ‰](mailto:?subject=%3Cspan%20id="hs_cos_wrapper_name"%20class="hs_cos_wrapper%20hs_cos_wrapper_meta_field%20hs_cos_wrapper_type_text"%20style=""%20data-hs-cos-general-type="meta_field"%20data-hs-cos-type="text"%20%3EFastly%20Origin%20Shield:%20How%20Shielding%20Works%20and%20What%20It%20Costs%3C/span%3E&body=https://blog.blazingcdn.com/en-us/understanding-fastlys-origin-shield-and-its-cost-implications) ![BlazingCDN](https://blog.blazingcdn.com/hs-fs/hubfs/Logo/blog-logo-w.png?height=24&name=blog-logo-w.png) *Heavy traffic.* Light bill. The CDN for video and large traffic Their monthly bill vs ours - 20 TBFastly $2,087**$92.50** - 50 TBCDN77 $990**$215** - 200 TBCloudFront $11,965**$765** Published list prices, Aug 2026 [Calculate your cost](https://blazingcdn.com/cdn-cost-calculator/?utm_source=blog&utm_medium=sidebar&utm_campaign=blog_sidebar&utm_content=compare_calc) ## Related posts [![](https://blog.blazingcdn.com/hubfs/Gemini-Blog/image-Oct-14-2026-07-30-23-9310-AM.jpeg)](https://blog.blazingcdn.com/en-us/lossy-vs-lossless-compression-images-video-and-audio?hsLang=en-us) Learn ### [Lossy vs Lossless Compression: Images, Video and Audio](https://blog.blazingcdn.com/en-us/lossy-vs-lossless-compression-images-video-and-audio?hsLang=en-us) Lossy vs lossless compression comes down to one trade: lossless compression rebuilds every original bit and typically ... Oct 14, 2026, 9:32:43โ€ฏAM [Read more](https://blog.blazingcdn.com/en-us/lossy-vs-lossless-compression-images-video-and-audio?hsLang=en-us) [![](https://blog.blazingcdn.com/hubfs/Gemini-Blog/image-Oct-14-2026-07-00-56-2080-AM.jpeg)](https://blog.blazingcdn.com/en-us/using-cloudfront-with-s3-cost-analysis?hsLang=en-us) Pricing - Pricing & Costs ### [CloudFront vs S3 Direct: Real Cost Breakdown and When to Use Each](https://blog.blazingcdn.com/en-us/using-cloudfront-with-s3-cost-analysis?hsLang=en-us) The CloudFront vs S3 decision depends more on object size than on traffic volume. At a 500 KB average response, 100 TB ... Oct 14, 2026, 9:04:54โ€ฏAM [Read more](https://blog.blazingcdn.com/en-us/using-cloudfront-with-s3-cost-analysis?hsLang=en-us) [![BlazingCDN](https://blog.blazingcdn.com/hubfs/Logo/blog-logo-w.png)](https://blog.blazingcdn.com?hsLang=en-us) [๐Ÿ“˜ Learn](https://blog.blazingcdn.com/cdn-learn?hsLang=en-us) [๐Ÿ“Š Benchmarks](https://blog.blazingcdn.com/cdn-ratings-and-benchmarks?hsLang=en-us) [๐ŸŽฌ Video & Streaming](https://blog.blazingcdn.com/video-streaming-cdn?hsLang=en-us) [๐Ÿญ Industries](https://blog.blazingcdn.com/cdn-industry-insights?hsLang=en-us) [๐Ÿ’ฐ Pricing & Costs](https://blog.blazingcdn.com/cdn-pricing-and-cdn-costs?hsLang=en-us) [โšก Compare](https://blog.blazingcdn.com/cdn-comparison?hsLang=en-us) [๐Ÿ”’ Security](https://blog.blazingcdn.com/cdn-security?hsLang=en-us) [๐Ÿ› ๏ธ Tools](https://blog.blazingcdn.com/cdn-tools?hsLang=en-us) [โœ๏ธ Publish with us](https://blog.blazingcdn.com/publish-with-us?hsLang=en-us) in f ๐• โœ‰ Copyright ยฉ BlazingCDN |. All rights reserved. ```json { "@context" : "https://schema.org", "@id" : "https://blazingcdn.com/#organization", "@type" : "Organization", "description" : "High-volume CDN for video, live streaming, OTT/IPTV, software, games, SaaS and large-file delivery.", "logo" : { "@id" : "https://blazingcdn.com/#logo", "@type" : "ImageObject", "height" : 560, "url" : "https://blazingcdn.com/wp-content/uploads/2024/08/logo-560-560.png", "width" : 560 }, "name" : "BlazingCDN", "sameAs" : [ "https://www.linkedin.com/company/blazingcdn", "https://x.com/BlazingCdn", "https://www.reddit.com/r/BlazingCDN/", "https://www.wikidata.org/wiki/Q141711074" ], "url" : "https://blazingcdn.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://blog.blazingcdn.com/#website", "@type" : "WebSite", "inLanguage" : "en-US", "name" : "BlazingCDN Blog", "publisher" : { "@id" : "https://blazingcdn.com/#organization" }, "url" : "https://blog.blazingcdn.com/" } ``` ```json { "@context" : "https://schema.org", "@id" : "https://blog.blazingcdn.com/en-us/understanding-fastlys-origin-shield-and-its-cost-implications#article", "@type" : "BlogPosting", "author" : { "@id" : "https://blog.blazingcdn.com/en-us/author/blazingcdn#person", "@type" : "Person", "description" : "Vadym Borovskyi is Chief Product and Marketing Officer at BlazingCDN, where he has led product strategy and growth since 2021. He has more than 11 years of experience in IT product management and B2B marketing. On this blog he writes about CDN pricing and egress costs, video and software delivery, cache configuration, and how teams evaluate and switch CDN providers. He is based in Warsaw, Poland.", "image" : "https://143144902.fs1.hubspotusercontent-eu1.net/hubfs/143144902/vadym-borovskyi.jpg", "jobTitle" : "Chief Product and Marketing Officer", "knowsAbout" : [ "Content Delivery Networks (CDN)", "CDN pricing", "Video streaming delivery", "Software and game distribution", "Cache optimization", "Product Management", "B2B Marketing", "Digital Marketing", "Pay Per Click Marketing (PPC)", "Google Ads", "Search Engine Marketing (SEM)", "Marketing Strategy", "Artificial Intelligence (AI)", "Cloud Management", "SaaS Development", "IT Consulting", "Computer Networking", "Project Management", "Startups" ], "name" : "Vadym Borovskyi", "sameAs" : [ "https://www.linkedin.com/in/axelt/" ], "url" : "https://blog.blazingcdn.com/en-us/author/blazingcdn", "worksFor" : { "@id" : "https://blazingcdn.com/#organization" } }, "dateModified" : "2026-10-15T07:04:12Z", "datePublished" : "2026-10-15T07:04:12Z", "description" : "How Fastly shielding works, choosing a shield POP, effect on origin load and cache hit ratio, and what origin shield adds to your bill.", "headline" : "Fastly Origin Shield: How Shielding Works and What It Costs", "image" : "https://143144902.fs1.hubspotusercontent-eu1.net/hubfs/143144902/Gemini-Blog/image-Oct-15-2026-07-00-57-7561-AM.jpeg", "inLanguage" : "en-us", "isPartOf" : { "@id" : "https://blog.blazingcdn.com/#website" }, "mainEntityOfPage" : { "@id" : "https://blog.blazingcdn.com/en-us/understanding-fastlys-origin-shield-and-its-cost-implications", "@type" : "WebPage" }, "publisher" : { "@id" : "https://blazingcdn.com/#organization" }, "wordCount" : 2214 } ``` ```json { "@context" : "https://schema.org", "@id" : "https://blog.blazingcdn.com/en-us/understanding-fastlys-origin-shield-and-its-cost-implications#breadcrumb", "@type" : "BreadcrumbList", "itemListElement" : [ { "@type" : "ListItem", "item" : "https://blog.blazingcdn.com/en-us", "name" : "Blog", "position" : 1 }, { "@type" : "ListItem", "item" : "https://blog.blazingcdn.com/en-us/understanding-fastlys-origin-shield-and-its-cost-implications", "name" : "Fastly Origin Shield: How Shielding Works and What It Costs", "position" : 2 } ] } ``` ```json { "@context" : "https://schema.org", "@id" : "https://blog.blazingcdn.com/en-us/understanding-fastlys-origin-shield-and-its-cost-implications#faq", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Fastly does not charge a separate fee for origin shield as of 2026. The cost appears inside existing charges: an edge-to-shield hop counts as an additional request, and the shield-to-edge response counts as additional bandwidth. An uncached 1 MB response therefore produces about 2 MB of Fastly-billed transfer. Confirm on your contract whether shield-to-origin fetches are metered separately." }, "name" : "Does Fastly charge extra for origin shield?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Pick the Fastly shield POP with the lowest round-trip time to your origin, usually the POP in the same metro as your cloud region. Each backend gets one shield, so multi-region origins need separate backends. Validate candidates by comparing shield-to-origin first-byte time in your logs, and size the origin for the unshielded miss rate in case the shield fails." }, "name" : "How do I choose a Fastly shield POP?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Fastly shielding saves money on egress when the shield hit ratio exceeds your Fastly per-GB rate divided by your origin egress per-GB rate. At $0.02 and $0.05 per GB, that threshold is 40%. Request fees push it higher. Below the threshold, shielding can still be worth enabling for origin protection during purges, releases and traffic spikes." }, "name" : "What shield hit ratio makes Fastly shielding worth it?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Amazon CloudFront charges an explicit per-request fee for Origin Shield, roughly $0.0075 to $0.016 per 10,000 requests depending on region, based on recent list prices. Fastly has no shield line item but bills each shielded miss as an extra request and extra bandwidth. Both models cost the most on workloads with many cache misses." }, "name" : "How does origin shield pricing differ between Fastly and Amazon CloudFront?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Fastly shielding usually adds cost and latency for authenticated APIs, personalized responses and live manifests. These requests pass through both tiers without being reused, so every response is billed twice and gains an extra hop. Bypass the shield for those paths and keep it for long-TTL static content, VOD segments and large downloads, where shield hit ratios stay high." }, "name" : "Should Fastly shielding be used for APIs and live streaming?" } ] } ```