A shield-layer matrix across the major CDNs: who ships origin shielding, how each implements it, and where the meter runs.
Winner depends on your workload.
Winner depends on: whether you want the shield free and simple (Bunny, KeyCDN, Cloudflare's tiered cache), contractually engineered (Akamai, Fastly), or metered per request as an AWS line item (CloudFront) — and whether your real problem is origin load or origin egress cost, which are not the same fix.
The same idea, four billing philosophies
Every origin shield is the same architectural move: nominate one cache location as the funnel, make every other edge location fill from it, and let the origin see one fetch instead of dozens. What differs — dramatically — is how vendors charge for that funnel. Some treat it as table stakes and include it. Some treat it as configuration and let the indirect meters run. One prices it as an explicit per-request line item. Below is the field as we verify it against provider documentation in July 2026.
| Provider | Shield mechanism | What it costs |
|---|---|---|
| Amazon CloudFront | Origin Shield — an extra regional cache layer you pin to an AWS Region | Explicit surcharge: from roughly $0.0075 per 10,000 shield requests in US regions, more elsewhere; no free tier |
| Fastly | Shielding — designate any POP as the shield, per origin; Media Shield sold separately for multi-CDN video | No feature fee, but edge-to-shield fetches are billable requests and bandwidth, so the meter runs indirectly |
| Cloudflare | Tiered Cache — upper-tier data centers shield the origin; topology varies by plan | Included on all plans; Cache Reserve (R2-backed persistent shield) is a separate paid add-on |
| Akamai | Tiered Distribution parent tiers; Site Shield restricts which Akamai ranges may contact the origin | Contract-dependent — engineered into the delivery config rather than a self-serve toggle |
| Bunny.net | Origin Shield — pick a shield location; Perma-Cache stores objects permanently on edge SSD storage | Shield free, including internal shield-to-edge traffic; Perma-Cache billed as Bunny Storage from $0.01/GB |
| KeyCDN / CDN77 / Gcore | Origin shield options in the zone or resource settings | Included in standard pricing on the plans we can verify; confirm per contract at higher tiers |
CloudFront: the only explicit meter
CloudFront is the outlier that prices shielding as its own SKU. Enabling Origin Shield adds an incremental charge for every request that flows through the shield layer — AWS's own guidance is to model roughly ten percent of HTTPS requests reaching it on a well-cached distribution, which keeps the fee modest, but dynamic traffic changes the math: PUT, POST, PATCH and DELETE always traverse the shield as an incremental layer, and GET requests with TTLs under an hour are treated the same way. The formula is simple — shield requests divided by 10,000 times the regional rate — and worth actually running, because on API-shaped traffic the surcharge buys you request collapsing rather than cache hits. That can still be worth it; it just is not free the way the marketing diagram implies.
Fastly: free feature, indirect bill
Fastly's shielding is the opposite shape: no feature fee at all, but every fetch from an edge POP to the shield POP is ordinary billable traffic. Fastly's own documentation is admirably direct that shielding can increase costs, and lets you set a different shield per origin — useful when origins live on different continents. For broadcasters running several CDNs in front of one packaging origin, Fastly also sells Media Shield as a standalone product, effectively renting its shield tier to traffic that will be delivered by someone else's edge.
The included tier
Cloudflare folded shielding into the platform: Tiered Cache is on for every plan, routing misses through upper-tier data centers before the origin, with smarter topologies on higher plans. Bunny goes further on price — its Origin Shield is free and the internal traffic between shield and edge is explicitly not billed — and its Perma-Cache feature converts shielding into permanent edge storage for near-total origin offload at storage rates. KeyCDN, CDN77 and Gcore all expose shield settings within standard pricing. The pattern across the value tier is clear: shielding has become a checkbox, not a product.
Akamai: engineered, not toggled
Akamai's answer predates the term. Tiered Distribution parents have shielded origins for two decades, and Site Shield adds the security half — publishing the specific Akamai ranges allowed to reach your origin so you can firewall everything else, a concern we unpack in Imperva vs Akamai security. What you will not find is a self-serve price: shield topology on Akamai is part of the delivery configuration your account team engineers, and its cost is wherever your contract puts it.
How to choose
Decide what the shield is for. If the problem is origin egress cost — an S3 or R2 bill — Bunny's free shield or Cloudflare's tiered cache solves it for nothing, and Perma-Cache or Cache Reserve solves it permanently for storage money. If the problem is origin fragility under concurrent misses, request collapsing is the feature that matters, and CloudFront's paid shield and Fastly's shield POPs both do it well. If the problem is multi-CDN — several networks hammering one origin — a single shared shield tier (Fastly Media Shield, or one CDN's shield fronting the rest) is the honest architecture, which is the same seam we measured in the multi-CDN guide. Facts verified against provider documentation, July 2026.
Not sure whether a shield layer would cut your origin bill or just add a hop? The assessment models both against your real traffic.