Fastly origin shield has no separate line item on a Fastly invoice as of 2026. A shielded cache miss is billed as an extra request plus extra bandwidth between the edge POP and the shield POP, so an uncacheable 1 MB response generates roughly 2 MB of Fastly-billed transfer before your cloud provider adds origin egress. This article explains how Fastly shielding routes a miss and how to pick the shield POP. It also includes before-and-after origin request math, a break-even formula with threshold values, and how tiered caching is billed at four other CDNs.
Shielding pays for itself on egress alone only when the shield hit ratio exceeds your effective Fastly per-GB rate divided by your origin egress per-GB rate. With a $0.02 per GB Fastly contract rate and $0.05 per GB cloud egress, the break-even shield hit ratio is 40%. Below that line you are paying for origin protection, not savings.
Without shielding, every Fastly POP that misses fetches from your origin independently. An object that is popular in 30 POPs is pulled up to 30 times per TTL window. With shielding enabled, you designate one shield POP per backend. Every other POP forwards its misses to that POP instead of to the origin, so the origin sees one fetch per object per TTL window, regardless of how many POPs requested it.
The request path for a miss at both tiers is edge → shield → origin → shield → edge. The edge node marks the forwarded request with the Fastly-FF header. At the shield, request collapsing merges concurrent misses for the same cache key into a single origin fetch. Clustering already deduplicates fetches across nodes inside one POP, and shielding extends that deduplication across POPs. Users close to the shield POP get a single hop, because their edge is the shield. When the shield returns an object, the edge reads the Age header and caches it for the remaining TTL, so both tiers expire together. For vendor-neutral background on cache hierarchies, see the CDN fundamentals hub.
Any request that crosses both tiers executes vcl_recv on the edge node and again on the shield node. Logic that is not idempotent breaks quietly. A path prefix gets added twice, a query parameter is appended twice, or an origin auth header is computed from already-rewritten input. Geolocation also changes meaning. At the shield, client.geo describes the edge node rather than the user, so geo-based routing must be captured at the edge into a request header.
The usual guards are to run edge-only logic when fastly.ff.visits_this_service equals zero, and to run origin-only logic (signing, host rewrites) only when req.backend.is_origin is true. Pass-through traffic still takes the two-hop path, which is why APIs and personalized responses are the first candidates for bypassing the shield.
Choose the Fastly shield POP with the lowest round-trip time to your origin, which in practice means the POP in the same metro as your cloud region: an Ashburn-area POP for an origin in us-east-1, or a Frankfurt-area POP for eu-central-1. A shield more than a few milliseconds from the origin adds that latency to every shield miss.
The worked example below uses stated assumptions, not measurements: 2 billion requests and 50 TB delivered per month, an 85% edge hit ratio, a uniform object size, and an 80% shield hit ratio once shielding is on.
| Metric (per month) | No shield | Shield at 80% hit |
|---|---|---|
| Origin requests | 300 million | 60 million |
| Origin egress | 7.5 TB | 1.5 TB |
| Total origin offload | 85% | 97% |
| Extra Fastly-billed requests | 0 | 300 million |
| Extra Fastly-billed transfer | 0 | 7.5 TB |
Shielding cuts origin load fivefold in this model, but every edge miss becomes a billable Fastly request and transfer whether the shield hits or not.
The fan-out view is just as useful for capacity planning. Take one object requested in 30 POPs with a 10-minute TTL. Without a shield it can cost 30 origin fetches every 10 minutes, or 4,320 a day. With a shield it costs 144 a day. That 30x ratio is what protects an origin during a release or a cache purge.
Fastly origin shield pricing has no fixed fee in 2026. The cost is indirect: per Fastly documentation, each edge-to-shield hop counts as an additional request, and the shield-to-edge response counts as additional bandwidth at your contracted rate. Origin egress drops in exchange. Whether the net is positive depends on two per-GB rates and your shield hit ratio.
Fastly's published rate card reaches about 20 TB, where a month costs $2,087 (published price lists, checked August 2026). Above that, effective rates are quote-based and vary widely by commitment. Check with your account team whether shield-to-origin fetches are metered on your contract. Hyperscaler internet egress list prices for the first tiers typically run $0.05 to $0.09 per GB as of 2026.
| Effective Fastly rate | Origin egress $0.05/GB | Origin egress $0.09/GB |
|---|---|---|
| $0.01/GB | 20% | 11% |
| $0.02/GB | 40% | 22% |
| $0.04/GB | 80% | 44% |
| $0.08/GB | Never on egress alone | 89% |
The higher your effective Fastly rate relative to origin egress, the higher the shield hit ratio needed before shielding saves money rather than only protecting the origin.
Request fees move the threshold further. Apply the earlier model at $0.02 and $0.05 per GB. The origin egress saved is 6,000 GB times $0.05, or $300, and the added transfer is 7,500 GB times $0.02, or $150. That leaves $150 net. If the contract also charges an illustrative $0.0075 per 10,000 requests, the 300 million extra requests add $225, and the month ends $75 worse off. In that case shielding pays only through the origin compute and capacity it avoids, which is often the larger number anyway.
| Vendor | Shield tier cost | Billing model | Limitation to know |
|---|---|---|---|
| Fastly | No separate fee | Shield hops billed as requests and bandwidth | VCL runs on both tiers; misses are billed twice |
| BlazingCDN | Included on every plan | Per-TB tiers, no request fees | Delivery layer only: no HTTP/3, WebSockets or WAF |
| Amazon CloudFront | Roughly $0.0075 to $0.016 per 10,000 shield requests (estimate, recent list prices) | Per-request Origin Shield charge | One shield region per origin |
| Cloudflare | Smart Tiered Cache at no extra charge | Part of plan pricing | Custom topologies require Enterprise |
| bunny.net | Optional per pull zone | Per-GB delivery pricing | Short list of shield locations |
Fastly and Amazon CloudFront make you pay per shielded miss in some form, while the others fold the tier into delivery pricing.
As of October 2026, BlazingCDN includes origin shield and request coalescing on every plan and bills from $5 per TB down to $2.50 per TB at volume, with one rate for US, Europe and Asia and no request fees. The 50 TB month in the model above costs $215, against $2,087 for 20 TB on Fastly's published rate card, and the BlazingCDN vs Fastly comparison covers the feature differences. Below about 46 TB a month, flat plans such as Amazon CloudFront Business ($200 for 50 TB) or Cloudflare Pro ($25) can cost less.
| What breaks | How it shows up | How to confirm |
|---|---|---|
| Frequent purges | Shield hit ratio collapses after each deploy | Overlay purge timestamps on origin request rate |
| High-cardinality cache keys | Shield hit ratio stuck below 30% | Count distinct keys per URL from Vary, cookies and query strings in logs |
| Live manifests, short TTLs | Objects expire before a second POP asks | Compare TTL with median inter-request gap per object |
| Distant shield POP | p95 miss latency rises after enabling | Shield-to-origin first-byte time in logs |
| Double VCL execution | Malformed origin URLs, wrong geo routing | Origin access logs filtered on the Fastly-FF header |
| Shield POP unhealthy | Sudden fan-out surge at origin | Origin requests lacking a shield hop spike together |
Most shielding regressions show up first in the origin access log, not in Fastly dashboards, so instrument the origin before you enable the shield.
Request a cacheable object twice from two regions and read the response headers. Under shielding, X-Served-By lists two cache nodes, and X-Cache shows two values, edge state then shield state, such as MISS then HIT. At the origin, every request should carry the Fastly-FF header. A rising share of requests without it means the shield is being bypassed.
Measure each service for seven days before deciding. Track edge misses, shield hit ratio, origin fetch volume, request counts and bandwidth, then plug your contracted rates into the break-even table. Static assets, image libraries, VOD segments and software downloads with long TTLs usually clear the threshold. Authenticated APIs, personalized HTML and live manifests usually do not, and they belong on a bypass rule.
The cheapest gain usually comes before shielding. Normalize cache keys, extend practical TTLs, and batch purges. Each raises both edge and shield hit ratios, and shielding only multiplies what the cache key design already allows.
Fastly does not charge a separate fee for origin shield as of 2026. The cost appears inside existing charges: an edge-to-shield hop counts as an additional request, and the shield-to-edge response counts as additional bandwidth. An uncached 1 MB response therefore produces about 2 MB of Fastly-billed transfer. Confirm on your contract whether shield-to-origin fetches are metered separately.
Pick the Fastly shield POP with the lowest round-trip time to your origin, usually the POP in the same metro as your cloud region. Each backend gets one shield, so multi-region origins need separate backends. Validate candidates by comparing shield-to-origin first-byte time in your logs, and size the origin for the unshielded miss rate in case the shield fails.
Fastly shielding saves money on egress when the shield hit ratio exceeds your Fastly per-GB rate divided by your origin egress per-GB rate. At $0.02 and $0.05 per GB, that threshold is 40%. Request fees push it higher. Below the threshold, shielding can still be worth enabling for origin protection during purges, releases and traffic spikes.
Amazon CloudFront charges an explicit per-request fee for Origin Shield, roughly $0.0075 to $0.016 per 10,000 requests depending on region, based on recent list prices. Fastly has no shield line item but bills each shielded miss as an extra request and extra bandwidth. Both models cost the most on workloads with many cache misses.
Fastly shielding usually adds cost and latency for authenticated APIs, personalized responses and live manifests. These requests pass through both tiers without being reused, so every response is billed twice and gains an extra hop. Bypass the shield for those paths and keep it for long-TTL static content, VOD segments and large downloads, where shield hit ratios stay high.
This week, export seven days of edge miss bytes, request counts and shield hit ratio per Fastly service. Divide your effective Fastly per-GB rate by your origin egress rate, compare the result with each service's shield hit ratio, and list the services that fall below the line. Those services are the ones to fix with cache key cleanup or to move to a bypass rule. Origin access logs filtered on the Fastly-FF header will show whether the change worked.
If the heavy, cacheable part of that traffic is video, downloads or images, the BlazingCDN cost calculator prices the same monthly volume on progressive tiers from $5 per TB, with origin shield included.