"The site is slow" arrives with no units, no URL and no geography, and the instinct it triggers — jump into the CDN dashboard and start toggling — is how twenty-minute problems become two-day problems. Slowness behind a CDN is a layered system, and the layers can each be interrogated in order. This is the order.
Step one: characterize before you touch anything
Turn the report into coordinates: which URL, for whom, since when, how slow. One user or many? One geography or all? One page or the whole estate? Constant or intermittent? Five minutes of questions and a glance at RUM segments usually collapses the search space by 90% — "checkout, Brazil, since Tuesday's deploy, p90 doubled" is a different investigation from "everything, everywhere, slightly worse". While characterizing, check the trivial candidates that solve a surprising share of cases: a deploy that coincides with the start time, an expired cache-warming job, a marketing campaign that changed the traffic mix, or a provider incident already on the status page.
Step two: the browser tells you which third
Reproduce in a browser with DevTools open (or with a synthetic run from the affected geography if you can't see it locally) and read the timing breakdown for the slow request. It splits the problem into thirds. Setup — DNS, connect, TLS — points at resolvers, routing or handshake configuration, and is geography-flavoured. Waiting-for-first-byte points at the edge or origin, and sends you to step three. Content download points at payload size or the client's network — check bytes transferred and whether compression happened. If the document itself is fast but the page feels slow, the problem is front-end (a blocking third-party script, a huge image) and delivery triage stops here; hand it over with the waterfall attached.
Step three: the log line tells you which side
For a slow first byte, pull the edge log lines for the affected URL and window (the sight-reading guide is the companion here). Two fields settle jurisdiction instantly: cache status and origin-fetch time. This is also the moment to compare the edge's total time against the user's measured wait — if the edge says 40 ms and the user experienced 900, the missing 860 live on the network between the user and the POP, and the POP code tells you whether users are even being served from a sensible location. Jurisdiction settled, walk the branch.
The four branches
Slow hit. Cache says HIT, origin untouched, but the edge took long — rare, and a provider conversation: a struggling POP, an overloaded feature on the request path. Escalate with log lines and timestamps. Slow miss. MISS with origin time dominating: the CDN is a bystander; take the URL and duration to the application team, and separately ask whether this path deserves a shield or better TTLs so fewer users ride it. Shouldn't-be-a-miss. MISS or PASS on content that ought to be cached: the highest-value branch, because fixing it fixes every future user — the culprit is a TTL, a cookie, a Vary header or a fragmented cache key, and the log line's URL and headers name it. Slow client. Edge fast, origin fast, download long, bytes large: the payload is the problem, and the fixes are compression, image weight and asset diet, not delivery config. Most real incidents are branches two and three wearing each other's clothes; the log line is what tells them apart.
Closing the loop
Triage isn't done at diagnosis; it's done at prevention. Every incident ends with three artifacts: the fix (or the ticket in the owning team's queue, with the waterfall and log lines attached so nobody re-litigates jurisdiction), the regression guard — a synthetic check or RUM alert on the exact segment that regressed, so this failure mode pages someone next time instead of trickling in as a vibe — and a one-paragraph note of what the signature looked like, because slow-page signatures repeat, and a team that keeps its notes triages the second occurrence in five minutes. Over a few quarters the notes become your own flowchart, tuned to your estate, and "the site is slow" stops being a dreaded ticket and becomes a solved genre.