What Is a CDN? Content Delivery Networks Explained

## Why it matters

A CDN does three things. First, it caches your site's assets at servers worldwide, so a visitor in Japan gets your images from Japan, not from your data centre in Virginia. That cuts latency. Second, it absorbs traffic spikes and DDoS attacks by distributing the load across its edge network. Third, increasingly, it runs compute at the edge: middleware, image transformation, request rewriting.

But a CDN also changes what Scalpel Stack can see. Because the CDN sits in front of your origin server, it can rewrite or omit response headers. The real server stack is behind the CDN. Detecting which CDN is in front is the first step to reading what's behind it. Sometimes a CDN obscures the origin entirely. Sometimes the headers leak through anyway.

## How it works

When you request a page from a CDN-backed site, your request goes to the CDN edge server nearest you, not to the origin. The CDN either serves a cached copy or forwards the request to the origin, collects the response, caches it, and serves it to you. All of this is transparent to the browser, but it leaves fingerprints.

CDNs reveal themselves through several channels.

Response headers are the most authoritative. Cloudflare adds Server: cloudflare and a cf-ray header. Fastly adds Via: fastly and X-Served-By: Fastly. Akamai adds X-Akamai-Transformed or Pragma: akamai-transformed. These headers are the direct signal. They're also often removed by security-conscious sites.

Asset URLs leak the CDN in the hostname. If images and scripts are served from cdn.cloudflare.com, cdn.fastly.net, or d1a3f4spucxvzq.cloudfront.net, the CDN is in the URL. These hostnames are fingerprints on their own.

The Via header is part of HTTP semantics. Every proxy or cache that touches a response should add itself to the Via header. A chain like Via: 1.1 varnish, 1.1 cloudflare shows every hop. Not all CDNs comply, and not all remove it, but when it's there it's reliable.

TLS certificates also betray the CDN. The TLS handshake exposes the server certificate, and many CDNs use a wildcard or organisation certificate that names the CDN provider.

Scalpel Stack detects CDNs primarily through response headers (which requires the on-demand "Check HTTP headers" button) and asset URL patterns. Because a CDN fronts the origin, detecting one is often the end of the story for backend detection: the real server, language, and database are masked.

## What does not matter

Detecting a CDN tells you the site is behind it, but not which origin it's masking. Cloudflare in front of an Apache server and Cloudflare in front of nginx look identical to the browser. The CDN's own stack (it uses a lot of open-source software) is different from the origin's stack.

Also, many sites use multi-CDN strategies. A primary CDN for the main site, a different one for assets, a third for video, a fourth for API endpoints. Scalpel Stack reports what it detects; it can't infer the unstated fallbacks or the load-balancing rules.

And a CDN doesn't have to be "on the way" to be present. A site might be behind no CDN for the HTML response but use Cloudflare's email security, DNS service, or Workers compute tier. That infrastructure wouldn't show up in the page fingerprints, though some Cloudflare deployments do leave traces.

## Code example

Here's what CDN detection looks like in practice:

Response headers (requires "Check HTTP headers" button):

HTTP/1.1 200 OK
Server: cloudflare
CF-Ray: 835a1b2c3d4e5f6g-ORD
CF-Cache-Status: HIT
Via: 1.1 cloudflare
Copy

Asset URLs:

<img src="https://cdn.example.com/images/hero.jpg" />
<script src="https://cdn.fastly.net/lib/react@18.js"></script>
<link rel="stylesheet" href="https://d1a3f4spucxvzq.cloudfront.net/styles.css" />
Copy

Each one reveals the CDN in the hostname.

TLS certificate:

When you click the lock icon in your browser's address bar and inspect the certificate, you might see the issuer is "Cloudflare Inc" or the subject alternative name is *.example.cloudflare.com, confirming the CDN.

## How Scalpel shows it

Scalpel Stack detects CDNs when you click "Check HTTP headers". If the response includes characteristic headers or a CDN-specific hostname pattern, the CDN is reported. The detection might include the CDN's version or additional metadata if the headers expose it.

The CDN row appears under a "CDN" category header, grouped with other infrastructure. Because a CDN usually masks the origin, detecting one often ends HTTP header detection's usefulness for reading the backend. Scalpel Stack shows you what's in front; what's behind remains private, which is the CDN's job.