How CDNs Sit in the Detection Path

Most large sites are not spoken to directly by their visitors. A delivery network terminates the connection at an edge location, and that placement determines who can observe what.

The edge terminates the connection

The client's handshake completes with an edge node, not with the origin server. All transport-level negotiation therefore happens between the visitor and the network's infrastructure.

The edge then makes its own separate connection back to the origin, reusing it across many visitors. That second connection has nothing to do with the first.

Everything downstream of the edge sees the edge's client behaviour, not the visitor's. This is the single fact that explains most confusion about origin logs.

Edge nodes see transport details the origin never will

Handshake parameters, connection preambles and protocol negotiation are all observed at the edge and discarded there unless the network deliberately forwards a summary.

This is why transport-level detection is usually a delivery network feature rather than something a site implements itself. The site is not in a position to observe the inputs.

Where such signals are made available, they arrive as added request headers computed at the edge. The origin is consuming a conclusion rather than the raw evidence.

Origin logs show the edge's view

Unless the network is configured to forward the original address, the origin records the edge node's address on every request. Analytics built on those logs describe the network's topology.

Forwarded-address headers solve this, but they are self-reported data added by an intermediary. They are trustworthy only when the origin refuses requests that do not arrive from the network.

Getting that configuration wrong is a recurring source of both broken geography reporting and address-based controls that can be influenced by the client.

Caching hides traffic from origin analytics

A request served from cache never reaches the origin at all, so it appears in no origin log. The origin's traffic picture is systematically incomplete.

Automated traffic that only fetches cached pages is therefore invisible to the site while being fully visible to the network. The two parties genuinely disagree about volume.

Reconciling them requires reading the edge's own logs, which is why detection and analytics are increasingly consumed as network-level products.

Header forwarding is a contract

What reaches the origin is exactly what the edge chooses to send. Headers may be normalised, reordered, added or dropped according to the network's configuration.

Any detection logic the origin runs on header details is therefore measuring the edge's output. Signals that depend on the client's original request formatting have to be evaluated where that request arrived.