---
title: "What is an origin shield? The cache layer that protects your origin — warmup.rocks Glossary"
description: "An origin shield is a mid-tier CDN cache that absorbs edge misses before they reach your origin. How it raises hit ratios, cuts origin load, and how it differs from tiered caching."
canonical: https://warmup.rocks/glossary/origin-shield
---

# Origin shield

An **origin shield** is a designated CDN cache layer that sits between the edge [PoPs](https://warmup.rocks/glossary/point-of-presence) and your origin. When an edge location misses, it asks the shield instead of your server; only if the shield misses too does the request reach the origin. Many simultaneous edge misses for the same URL collapse into a single origin fetch.

## What it buys you

-   **Origin offload:** hundreds of PoPs no longer fetch independently. After a [purge](https://warmup.rocks/glossary/cache-purge) or a traffic spike, the origin sees one refill request instead of one per PoP.
-   **Request collapsing:** concurrent misses for the same object wait for one shield-to-origin fetch rather than stampeding the origin (the "thundering herd" problem).
-   **A second chance at a hit:** an object [evicted](https://warmup.rocks/glossary/cache-eviction) at a small edge PoP is often still on the bigger, hotter shield — the visitor pays a shield round trip instead of a full origin round trip.

## Shield vs. tiered caching

The concepts overlap: an origin shield is typically _one_ designated PoP (ideally near your origin) acting as the single upper tier — CloudFront Origin Shield, Fastly shielding, bunny.net Perma-Cache serve this role. [Tiered caching](https://warmup.rocks/glossary/tiered-cache) generalizes it to a hierarchy of upper-tier data centers, the way Cloudflare's Tiered Cache does. Same idea — put more cache between edge and origin — different topology.

## What a shield doesn't change

The shield protects your _origin_, not your _visitor_. An edge miss still costs the visitor the edge-to-shield round trip — less than a full origin trip, but far from a local hit. The far-away PoPs where misses are most common are also farthest from a shield near your origin. Shields and [cache warming](https://warmup.rocks/blog/what-is-cache-warming) are therefore complements: the shield makes misses cheaper, warming makes them rarer.