Authoritative DNS
The job: answer the question of which address your hostname points to
Authoritative DNS hosting on every plan including the free one, served from an anycast network, with DNSSEC signing available and record changes that take effect quickly. Using the rest of the platform generally means moving your nameservers here, so DNS is the entry point rather than an add on.
- Amazon Route 53
-
Authoritative DNS with health checks, failover records, and routing policies based on latency, geography or weighting. It reads addresses inside Amazon Web Services natively, so pointing at load balancers and buckets is direct.
Where it stopsRouting sophistication does not bring filtering with it. Health checked failover is a resilience tool, not a security tool, and per zone plus per query billing means a busy zone is a line item rather than a rounding error. - NS1 and similar traffic steering services
-
Built for steering traffic across several origins using real signals, which matters when you run more than one delivery network and want to move load between them.
Where it stopsThe steering logic is the product. If you have a single origin and a single delivery network, you are paying for a decision engine with nothing to decide. - Registrar bundled DNS and small independents such as DNSimple or deSEC
-
Perfectly adequate for a zone with a handful of records. Independents tend to have clearer interfaces and honest API access, and deSEC is run as a non profit with DNSSEC on by default.
Where it stopsCapacity under attack varies widely and is rarely documented in a way you can verify before you need it. Advanced record types, fine grained access control for a team, and audit logs are often absent.
What it depends on
Whether DNS is a standalone decision at all. If you want the rest of one platform, the nameserver choice is usually made for you. If you deliberately want DNS held somewhere separate from your delivery network, so that a single account problem cannot take away both, then a separate provider is the point rather than a compromise.
Content delivery and caching
The job: hold copies of your content close to visitors so the origin is asked less often
Caching on a global network with rules for what gets cached and for how long, tiered caching so edge locations ask an upstream location before the origin, and purge controls. Static caching is available on the free plan, which is unusual in this category.
- Fastly
-
Configuration is the product. Its configuration language lets you express cache and routing logic precisely, and purges propagate very quickly, which suits sites where content changes constantly and staleness is the main risk.
Where it stopsThat control assumes someone to wield it. Teams that want sensible behaviour without writing configuration will find the default state thinner, and there is no free ongoing tier comparable to the free plan model. - Amazon CloudFront
-
The natural fit when the origin already lives in Amazon Web Services. It reads from buckets and load balancers with native permissions, uses the same identity and policy system as the rest of the account, and data moving from those origins to the delivery network is treated favourably compared with open internet egress.
Where it stopsOutside that ecosystem the advantage thins. Configuration follows cloud console idioms rather than web publishing ones, and the bill is assembled from several separate meters, which makes forecasting harder than a flat subscription. - Bunny.net
-
Straightforward delivery and image handling at low per gigabyte rates, with a control panel that a small team can learn in an afternoon. A reasonable answer when the requirement really is just to serve files quickly.
Where it stopsThe security tooling around the cache is lighter. If you need managed firewall rulesets, sophisticated bot handling or a zero trust product from the same vendor, this is not where those live. - Akamai
-
A long established delivery network with a very broad feature surface and enterprise support arrangements, used heavily by organisations with complex media, commerce or regulatory requirements.
Where it stopsEngagement is sales led and contract based. There is no meaningful path for an individual or small team to self serve, and the configuration surface assumes dedicated staff. - Google Cloud CDN and Azure Front Door
-
Sensible defaults when your compute already sits in Google Cloud or Azure, since they inherit that platform's identity, logging and networking rather than adding a separate account to manage.
Where it stopsThe value is mostly the integration. As a delivery network chosen on its own merits for an origin hosted elsewhere, the case is weaker.
What it depends on
Where your origin already is, how much cache logic you actually need, and whether you would rather pay a predictable subscription or a usage meter. A site serving mostly static pages to a general audience has a genuinely wide field of adequate choices. A site with unusual cache keys, per user variation or very frequent invalidation narrows quickly.
DDoS mitigation
The job: absorb or discard flood traffic before it reaches your origin
Always on mitigation at both the network layer and the application layer, applied to all plans including free, without metering the attack traffic separately. Because traffic already passes through the network for delivery, mitigation is not a separate routing decision you make during an incident.
- AWS Shield
-
The standard tier is included for resources inside Amazon Web Services at no extra charge. The advanced tier adds cost protection for scaling charges incurred during an attack and access to a response team.
Where it stopsIt protects assets inside that cloud. The advanced tier carries a substantial monthly subscription with a long commitment period, which puts it out of scope for most small deployments regardless of how exposed they are. - Akamai Prolexic and comparable scrubbing services
-
Designed to protect whole networks rather than individual sites, by routing your address space through scrubbing centres. Appropriate when you announce your own addresses and need protection for services that are not web traffic.
Where it stopsThis is network operator tooling. If you do not run your own address space, most of the design is irrelevant to you, and the commercial arrangement matches that scale. - Your hosting provider or transit provider
-
Many hosts include some baseline filtering, and for small attacks against small targets that is sometimes all that is required.
Where it stopsIncluded filtering is often described vaguely and some providers respond to a sustained attack by removing the target from the network, which protects them rather than you. Ask specifically what happens during an attack that exceeds their threshold.
What it depends on
One architectural fact matters more than the vendor choice. If an attacker can discover and reach your origin address directly, mitigation in front of it can be bypassed. Origin addresses leak through mail headers, old DNS records, certificate transparency logs and misconfigured subdomains. Restricting your origin to accept connections only from your chosen provider is the step that makes any of these products work as intended.
Web application firewall and bot handling
The job: inspect requests and decide which ones to block, challenge or allow
Managed rulesets maintained by the vendor, custom rules written against request properties, rate limiting, and separate bot handling features on higher tiers. Basic rate limiting and custom rules reach down into lower plans, with managed rulesets and the more detailed bot tooling sitting above them.
- AWS WAF
-
Rules attach to a delivery distribution, load balancer or API gateway, with managed rule groups available from Amazon and from third party vendors through the marketplace. Billing is per access control list, per rule and per million requests inspected.
Where it stopsBot handling of any sophistication means adding a separately priced product on top. Because every rule and every marketplace ruleset is its own meter, an enthusiastically configured firewall produces a bill that surprises people. - Fastly Next-Gen WAF
-
Takes a detection approach oriented around observed request behaviour rather than pattern matching alone, which tends to produce fewer blocks of legitimate traffic in applications with unusual request shapes.
Where it stopsIt is positioned at teams with security staff who will tune it. Without someone reading what it flags, much of the value stays unrealised, and it is priced for organisations rather than individuals. - Imperva and Akamai App and API Protector
-
Mature enterprise offerings with deep policy control, API specific protections and the reporting that compliance functions tend to ask for.
Where it stopsBoth are contracted enterprise products. Neither is a realistic choice for a small site, and both assume an operational process around the alerts they generate. - Self hosted rules with Coraza, ModSecurity and the OWASP Core Rule Set
-
Free, open source, and entirely under your control. The Core Rule Set is well maintained and widely reviewed, and running it at your own origin means no third party sits in the request path.
Where it stopsFiltering at your origin still requires the flood to reach your origin, so it does not substitute for upstream mitigation. Tuning to reduce blocks of legitimate traffic is ongoing work, and you see only your own traffic, so novel attack patterns reach you before you have any reason to expect them. - CrowdSec
-
Open source behavioural detection with community shared address reputation, sitting at your own infrastructure and usable alongside a delivery network rather than instead of one.
Where it stopsIt works from your logs, so it reacts to traffic that already arrived. Reputation data is only as useful as the overlap between what other participants see and what targets you.
What it depends on
The honest cost of this layer is not the subscription, it is false positives. Every ruleset blocks some legitimate requests, and the tolerance for that differs enormously between a marketing site and a checkout flow. Whichever product you pick, budget time for reviewing what it blocked rather than assuming the defaults suit your application.
Certificates and encrypted connections
The job: prove your identity to browsers and encrypt the connection
Certificates issued and renewed automatically for hostnames on the account, with the encrypted connection terminated at the edge and a separate connection made onward to your origin. Options exist for stricter verification of that second connection, and for presenting a certificate you supply yourself.
- Let's Encrypt with an automated client
-
Free certificates issued by an established non profit authority, renewed automatically by a client such as acme.sh or Certbot, or handled transparently by a server such as Caddy. Nobody else holds a private key for your hostname.
Where it stopsWildcard certificates require DNS based validation, which means giving the client access to change DNS records. Issuance is rate limited, so environments that create many hostnames need planning. When renewal fails silently, the failure is visible to your visitors before it is visible to you unless you monitor expiry separately. - Cloud managed certificates such as AWS Certificate Manager
-
Free for use with that cloud's own load balancers and delivery network, renewed automatically, with no key material to handle.
Where it stopsThe certificate cannot generally be exported for use on your own servers. It is a convenience inside one platform rather than a portable asset. - Commercial authorities and ZeroSSL
-
Relevant where a specific validation type, a warranty, or a support relationship is required, which occasionally appears as a procurement condition rather than a technical one.
Where it stopsFor ordinary encryption of a public website, browsers treat a free automated certificate and a paid one identically. The paid option buys process and paperwork, not stronger encryption.
Illustrative diagram of connection structure. It describes an arrangement rather than measuring anything, and it is not a security assessment of any named provider.
What it depends on
Whether anything in the request path should be readable by a third party. If it should not, then any proxying delivery network is the wrong shape, and the answer is your own termination with certificates you control. That choice costs you the caching and filtering that only work on readable traffic, which is the trade rather than an oversight.
Running code at the edge
The job: run small pieces of logic close to visitors instead of at the origin
Workers, a runtime built on the same engine as Chrome's JavaScript, with a free allowance of daily requests and a paid tier beyond it. Related services for key value storage, a SQL database and queues are designed to be called from the same runtime.
- Fastly Compute
-
Runs WebAssembly, so code can be written in Rust, Go, JavaScript and others, with fast start behaviour and tight integration with the same configuration system that drives its caching.
Where it stopsThe surrounding data services are thinner, so state usually lives somewhere else, and reaching across to it reintroduces the distance you moved the code to avoid. - AWS Lambda@Edge and CloudFront Functions
-
Two different tools. The lightweight one handles header and URL manipulation very cheaply at the edge. The heavier one runs full functions with access to the rest of the account, at a smaller set of locations.
Where it stopsThe lightweight option is deliberately restricted, with no network access from the function. The heavier option runs at regional locations rather than every edge, and deployment propagation is slow enough to make rapid iteration uncomfortable. - Deno Deploy, Vercel and Netlify edge functions
-
Aimed at application developers rather than infrastructure teams, with deployment tied to a repository and a strong story for framework based sites.
Where it stopsThey are part of a hosting platform. Choosing them for edge code generally means choosing where the whole application lives, which is a much larger decision than the one you started with. - Akamai EdgeWorkers
-
Edge execution within an existing enterprise delivery configuration, which suits organisations already running there.
Where it stopsAvailable as part of that commercial relationship, with limits designed around short request time work rather than general computation.
What it depends on
Portability is the thing to look at first. Every one of these runtimes has its own interfaces for storage, caching and configuration, so code written against one does not lift cleanly into another even when the language is the same. Keeping your logic in ordinary functions and confining the platform specific parts to a thin layer is what makes a later move possible. None of these replace a long running server process.
Object storage and the cost of sending data out
The job: hold files and serve them without the retrieval charges dominating the bill
R2, object storage with an interface compatible with the widely used S3 API, priced for storage and operations without a charge for data leaving to the internet. That pricing shape is the reason it gets discussed alongside delivery rather than as a separate storage decision.
- Amazon S3
-
The reference implementation of this category, with the deepest feature set, storage classes for different access patterns, lifecycle rules, versioning and mature tooling everywhere.
Where it stopsData leaving to the internet is charged per gigabyte, which for media heavy workloads can exceed the storage cost by a wide margin. Putting a delivery network in front changes the arithmetic, and is the usual reason people do it. - Backblaze B2 and Wasabi
-
Lower storage pricing with egress arrangements that are more generous than the large clouds, particularly when paired with a partnered delivery network.
Where it stopsNeither is a delivery network, so you still need one in front for anything latency sensitive. Feature surfaces are smaller, and specific terms around minimum retention or egress allowances deserve reading closely rather than assuming. - Google Cloud Storage and Azure Blob Storage
-
Equivalent services that make sense when the surrounding compute is already there and you want one identity system and one bill.
Where it stopsChosen independently of that context, the case rests on pricing details that change, so this is one to check rather than assume.
What it depends on
Compatibility with the S3 API is not the same as being S3. Most tools work against most of these, but edge cases in multipart uploads, conditional requests and less common headers differ. Test your actual tooling against a real bucket before treating a migration as settled.
Private access to internal systems
The job: let the right people reach internal applications without exposing them publicly
An access product that puts an identity check in front of internal applications, and a tunnel agent that connects your server outward so no inbound port needs opening. A free tier covers a limited number of users, which makes it reachable for small teams.
- Tailscale
-
A mesh network built on WireGuard that connects devices directly to each other, with a generous free tier and a setup that most people complete quickly. Excellent for reaching your own machines from your own devices.
Where it stopsIt is device oriented. Giving an external contractor browser only access to one internal web application, with per application policy and an audit trail, is closer to the gateway model and not what a device mesh is shaped for. - Twingate
-
Sits between the two ideas, with per resource authorisation, connectors that dial outward, and identity provider integration, aimed at small and mid sized teams.
Where it stopsThe free tier is tight, and it covers private access alone, so it does not fold into a wider platform if that consolidation is what you were after. - Zscaler, Netskope and Palo Alto Prisma
-
Full enterprise security platforms covering private access alongside web filtering, data loss prevention and policy across a large workforce.
Where it stopsThese are procurement exercises with deployment projects attached. For a team of ten they are the wrong size of answer regardless of quality. - Self hosted WireGuard or OpenVPN
-
No vendor, no per user charge, no third party in the path. For a small technical team that already runs servers, this remains a completely reasonable answer.
Where it stopsYou become responsible for key distribution, revocation when someone leaves, integration with your identity provider, and audit logging. Those tasks are what the commercial products are actually selling, so the saving is real but it is paid in attention. - Teleport
-
Focused on access to infrastructure such as servers, databases and clusters, with session recording and short lived credentials.
Where it stopsIts centre of gravity is engineering access. Publishing an internal dashboard to the finance team is not the problem it was designed around.
What it depends on
Who needs access and to what. Your own engineers reaching your own machines is a different problem from outside collaborators reaching one internal web application, and the products that are strongest at one are usually not the strongest at the other.
Which providers cover which layers
A map of product scope, not a scoreboard
The table below records whether a layer is part of what a provider sells, not how well it does it. A provider marked as covering a layer may be an excellent fit or a poor one for your particular case, and nothing here should be read as a rating.
| Provider | DNS | Delivery | DDoS | Firewall | Edge code | Storage | Private access |
|---|---|---|---|---|---|---|---|
| Cloudflare | in scope | in scope | in scope | in scope | in scope | in scope | in scope |
| Fastly | not offered | in scope | in scope | in scope | in scope | limited | not offered |
| Akamai | in scope | in scope | in scope | in scope | in scope | limited | limited |
| Amazon Web Services | in scope | in scope | in scope | in scope | in scope | in scope | limited |
| Bunny.net | in scope | in scope | limited | limited | in scope | in scope | not offered |
| Tailscale or Twingate | not offered | not offered | not offered | not offered | not offered | not offered | in scope |
| Assembled from open source | in scope | limited | not offered | in scope | limited | in scope | in scope |
Reading the marks: in scope means the provider sells something for that layer. limited means it exists but in a narrower form, or only in combination with another product. not offered means it is not part of that provider's offering and you would source it elsewhere. The open source row assumes you operate the servers yourself, which is why flood absorption sits outside it.
How the billing is shaped
The shape of the bill matters more than the headline number
Providers in this category bill in three quite different ways, and that difference affects budgeting more than the rates do. A subscription is predictable and indifferent to a traffic spike. A usage meter is cheap when quiet and unbounded when not. A contract is negotiated and usually annual.
Illustrative shapes only. The lines carry no numbers, are not drawn from any vendor's rates, and are not a measurement, a price quote or a forecast of what you would pay.
| Provider | How you are billed | Rough list range | Vendor pricing page |
|---|---|---|---|
| Cloudflare | Free tier, then a monthly subscription per domain, with enterprise terms quoted individually | Free, then roughly twenty to twenty five dollars a month at the first paid tier and roughly two hundred dollars a month at the tier above it | cloudflare.com/plans |
| Fastly | Usage based on data delivered and requests served, with regional rates | Fractions of a cent to a few cents per gigabyte depending on region, plus request charges | fastly.com/pricing |
| Amazon CloudFront | Free allowance each month, then usage based per gigabyte and per request, tiered by region and volume | Single digit cents per gigabyte in most regions, higher in some, falling with volume | aws.amazon.com/cloudfront/pricing |
| AWS WAF | Separate meters per access control list, per rule and per million requests inspected | Small monthly amounts per rule that accumulate quickly as rules are added | aws.amazon.com/waf/pricing |
| AWS Shield Advanced | Monthly subscription with a long commitment period, plus data transfer charges | Several thousand dollars a month, aimed at organisations rather than individual sites | aws.amazon.com/shield/pricing |
| Bunny.net | Usage based per gigabyte by region, with a small monthly minimum | Around one cent per gigabyte in lower cost regions, several times that in the most expensive ones | bunny.net/pricing |
| Akamai | Contracted, quoted individually, usually annual | Not published. Requires contact with the vendor | akamai.com |
| Tailscale | Free personal tier, then per user each month | Free for individual use, then single digit dollars per user each month | tailscale.com/pricing |
| Twingate | Limited free tier, then per user each month | Single digit dollars per user each month at published tiers | twingate.com/pricing |
| Object storage | Per gigabyte stored each month, plus operations, plus egress where it is charged | Roughly one to three cents per gigabyte stored each month, with egress terms as the variable that dominates | aws.amazon.com/s3/pricing |
These figures are given as ranges because that is the most that can honestly be said in a page that will still be online after the next pricing change. Do not budget from this table. Open the vendor's page, select your own country and billing period, and price your own traffic volume.
Traffic data, logs and where they sit
What a provider in the request path can see, and what that means for your obligations
Any provider that terminates encrypted connections on your behalf processes the contents of requests, including addresses, headers, cookies and anything your visitors submit. That is not a flaw, it is how caching and filtering work at all. It does mean the choice carries data protection consequences that a purely technical comparison would miss.
Four things are worth checking for any provider in this layer. What is retained, and for how long. Where processing physically happens, and whether you can constrain it to particular regions. What contractual terms are offered for processing personal data on your behalf. Whether the logs you need for your own security work are available on the plan you are actually buying, since detailed log access is frequently a higher tier feature.
This section is not legal advice
Data protection duties depend on your jurisdiction, the jurisdictions your visitors are in, the nature of the data and your role in processing it. Nothing here is legal or compliance advice, and it is not a statement of any provider's compliance status. Consult a qualified data protection practitioner or lawyer, and read the current published terms and documentation from the provider itself rather than relying on any summary, including this one.
Testing an alternative before committing to it
How to get evidence from your own traffic rather than from anybody's marketing
Most of what matters is specific to your site, so the useful evidence comes from running a real test rather than reading comparisons. A workable sequence looks like this.
- Lower the time to live on the records you plan to move, several days ahead, so that a change takes effect quickly and a reversal does too.
- Point one subdomain that carries real but non critical traffic at the candidate, and leave the main hostname alone.
- Measure from your own visitors rather than from a synthetic test location, since the geography of your actual audience is the only distribution that matters to you.
- Run it for a full billing cycle. Usage priced services reveal their real cost only across a month that includes your normal peaks.
- Exercise a purge and confirm how long stale content survives, since this is where delivery networks differ most in daily use.
- Deliberately trigger a firewall rule against your own application and check what a blocked legitimate visitor experiences.
- Open a real support ticket about a real question and observe the response, because support quality is difficult to assess any other way.
- Practise the rollback before you need it. Confirm that you can return to the previous arrangement inside an hour.
What transfers if you move, and what does not
The migration cost is concentrated in the configuration, not the content
Moving between providers in this category is rarely difficult in the sense of being technically hard. It is difficult in the sense that configuration accumulated over years lives in a dashboard and has no export path.
The practical consequence is that the cost of leaving grows with the amount of logic you push into any one provider's proprietary layer. That is worth knowing at the point when you adopt, not at the point when you leave.