8 Advanced Content Delivery Network Features
Many people enable their content delivery network service and leave it at that. While you might be taking advantage of all the primary CDN benefits, there are additional advanced features you can implement to take your content delivery to the next level. Some of these features can help you harden security on your CDN, lower costs by preventing bandwidth theft, and decrease the load on your origin server.
Advanced content delivery network features
Below are just a few advanced content delivery network features you may not yet be using.
1. X-Pull Key - Restricting CDN traffic
The X-Pull Key feature allows you to restrict traffic to your content delivery network. There are a couple reasons why you might want to do this:
- You want to rate limit bandwidth on your origin server
- You want to make sure everyone is using the CDN for better performance and not linking traffic to your server directly
- Create a custom logic on your origin server
- Restrict access to visible CDN URLs
- Distinguish KeyCDN traffic from other traffic on your origin server
The X-Pull Key feature is available within the KeyCDN dashboard by going to the Zone settings. By default it is set to
KeyCDN but you can change this value to up to a custom 15 alphanumeric value.
Another use case would be to restrict access to certain visible CDN URLs. For example, if you setup a custom CDN URL (e.g.
cdn.example.com) the root will normally be accessible. You could restrict access to this and instead return a
There is no specific
User-Agent when KeyCDN fetches content from your origin server. Instead the X-Pull Key feature allows you to distinguish KeyCDN traffic from other traffic on your origin server by modifying the request header.
GET /foobar.jpg HTTP/1.1 Host: your_origin_host X-Forwarded-Host: <zonename>-<id>.kxcdn.com X-Forwarded-For: 188.8.131.52 X-Forwarded-Scheme: http **X-Pull: KeyCDN** Connection: close Accept: */* User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_9_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2272.118 Safari/537.36 Accept-Language: en-US,en;q=0.8,de;q=0.6,ja;q=0.4 Cookie: foobar
Read more on how to restrict traffic to your CDN.
2. Zone Referrer (hotlink protection) - Prevent CDN bandwidth theft
Zone Referrer, also referred to as hotlink protection, is one of the easiest and quickest methods to implement which will prevent bandwidth theft. Hotlinking refers to someone directly linking to one of your images on their own server. What this means is that when someone visits their site it has to load the image from your CDN (edge server), taking up your bandwidth and actually costing you money.
By enabling hotlink protection requests without an HTTP referrer field are NOT allowed to access your assets. If they try, the asset will show up as on broken on their server, generating a
403 error in the header.
This is available within the KeyCDN dashboard by going to Zone Referrers. Check out our step by step tutorial on creating a Zone Referrer and enabling hotlink protection.
3. Secure Token - Limiting CDN accessibility by time
Secure Token allows you to generate secured links with an expiration time. Once a token has expired, it is not possible anymore to access the content. Unlike some other providers, KeyCDN provides Secure Token free with every account.
The Secure Token feature is available within the KeyCDN dashboard by going to the Zone settings. Example of how a Secure Token link would look like:
Check out our step by step tutorial on how to generate Secure Tokens.
4. Origin Shield - Reduce load on origin server
Origin Shield is basically an extra caching layer which reduces the load on your origin server and accelerates the distribution of your content from the origin server to your edge servers. Origin Shield is a great feature to reduce the traffic on your origin server to an absolute minimum and protect your infrastructure from abuse or traffic spikes.
The Origin Shield feature is available within the KeyCDN dashboard by going to the Zone settings.
First request with Origin Shield
Here is an example of what happens on the first request to your origin server.
Following requests with Origin Shield
After the first request, the following requests for the same content are served out of cache without requesting additional data from your origin server.
Unlike some other providers, KeyCDN provides Origin Shield free with every account!
5. Purge by
Cache-Tag - Programmatically purging
Cache tags are assigned to cached content through the
Cache-Tag response header. These can be used to programmatically purge only portions of cache instead of flushing the entire cache. The tags must be defined in the
Cache-Tag response header from the origin server.
This is available within the KeyCDN dashboard by going to Zones. Read more in our API documentation on how to use Purge Zone Tag.
Cache-Control - Speed up access
Cache-Control is an HTTP cache header comprised of a set of directives that allow you define when / how a response should be cached and for how long. Browsers store these, which in turn means they don't have to make an additional request to the server, speeding up access. You can add or modify the
Cache-Control response header fields that are sent to the client.
The Expires feature is available within the KeyCDN dashboard by going to the Zone settings.
- 0 Push Zone: disabled / Pull Zone: as received from the origin (header honoring)
Cache-Control: max-age=_t_, where t is the time specified in the directive in minutes converted to seconds
This setting overwrites the value received from the origin in case of a Pull Zone. The Expire setting value only impacts browser cache and not the KeyCDN cache. Read more about
7. Logging - Digging deeper into your data
KeyCDN provides you with real-time logs that can be accessed both via a browser or sent to a third party logging system. The logging feature allows you to run a live tail on your raw logs. It is also possible to define custom filters to drill down on your traffic pattern. This could be very helpful to identify broken links (Status:404) or if your content has been cached (Cache: HIT).
This is available within the KeyCDN dashboard under Reporting > Real-time Logs.
Here are some examples of some additional filter options.
You can then also see additional details on each log request.
8. HTTP Live Streaming - Speeding up video delivery
HTTP Live Streaming (HLS) is a technology, developed by Apple, for streaming live and on demand video. Live streaming has made some great advancements in the past few years as far as accessibility, usability, security, and configuration abilities. HTTP Live Streaming plays a big part in these advancements especially for mobile devices as it allows for these devices to access live media efficiently and seamlessly.
You can use KeyCDN to help supercharge your HLS live stream by creating a Pull Zone and enabling Optimize for HLS.
The Optimize for HLS feature is available within the KeyCDN dashboard by going to the Zone settings. Read our step by step tutorial on delivering HLS content with KeyCDN.
As you can see there are many additional ways you can take your content delivery network to the next level and really fine tune the delivery of your content to your visitors. From restricting CDN traffic, preventing bandwidth theft, using Secure Token, programmatically purging, tweaking cache control settings, digging into your log data, and speeding up the delivery of your video content with HLS.