Origin shield
An origin shield is a designated CDN cache layer that sits between the edge PoPs and your origin. When an edge location misses, it asks the shield instead of your server; only if the shield misses too does the request reach the origin. Many simultaneous edge misses for the same URL collapse into a single origin fetch.
What it buys you
- Origin offload: hundreds of PoPs no longer fetch independently. After a purge or a traffic spike, the origin sees one refill request instead of one per PoP.
- Request collapsing: concurrent misses for the same object wait for one shield-to-origin fetch rather than stampeding the origin (the "thundering herd" problem).
- A second chance at a hit: an object evicted at a small edge PoP is often still on the bigger, hotter shield — the visitor pays a shield round trip instead of a full origin round trip.
Shield vs. tiered caching
The concepts overlap: an origin shield is typically one designated PoP (ideally near your origin) acting as the single upper tier — CloudFront Origin Shield, Fastly shielding, bunny.net Perma-Cache serve this role. Tiered caching generalizes it to a hierarchy of upper-tier data centers, the way Cloudflare's Tiered Cache does. Same idea — put more cache between edge and origin — different topology.
What a shield doesn't change
The shield protects your origin, not your visitor. An edge miss still costs the visitor the edge-to-shield round trip — less than a full origin trip, but far from a local hit. The far-away PoPs where misses are most common are also farthest from a shield near your origin. Shields and cache warming are therefore complements: the shield makes misses cheaper, warming makes them rarer.