Monitoring behind a CDN: what Cloudflare and Fastly can hide

A CDN like Cloudflare or Fastly is one of the best things you can put in front of a site — faster loads, absorbed traffic spikes, fewer hits to your origin. But that same edge layer can mask problems from a monitor that isn’t looking carefully. A green check can mean “everything’s healthy” or “the CDN is serving a cached copy of a page whose origin died an hour ago.” Here’s how to tell them apart.

The cache can outlive the origin

The whole point of a CDN is to serve responses without touching your origin. So when your origin server falls over, the edge can keep serving cached pages — and a simple uptime check hitting the public URL sees 200 OK and reports “up.” Meanwhile, anything dynamic (logins, checkout, personalized data) is broken, because those can’t be served from cache. Your monitor is happy; your users aren’t.

Cache the static, verify the dynamic

The fix is to monitor the paths that can’t be cached, because those exercise the origin:

• Check a dynamic endpoint or an authenticated route, not just the cacheable homepage.
• Add a keyword assertion for content that only renders when the backend is truly working.
• Where appropriate, check the origin directly (or a health endpoint that bypasses cache) so you’re measuring the server, not the edge’s memory of it.

Between “is the cached page up?” and “can the origin actually serve a request?”, it’s the second question that matters.

Watch the edge itself, too

The CDN is now part of your critical path, so it deserves monitoring in its own right. A CDN misconfiguration, an expired origin certificate the edge rejects, or a regional edge issue can take you down even when your origin is perfectly healthy. Watching from multiple regions matters more here, not less — CDN problems are frequently regional, and a single-location check can’t see a POP that’s failing on the other side of the world.

Mind the headers and status codes

The edge can rewrite what a monitor sees. A 522/523/526 from Cloudflare means the edge couldn’t reach or validate your origin — treat those as origin-down, not as noise. Inspecting the response, not just trusting a 200, is what catches the difference.

The bottom line

A CDN improves resilience and can also hide a dying origin behind a cached copy. Monitor uncacheable and dynamic paths, assert on real content, check the origin where you can, and watch from multiple regions — so a healthy-looking edge never lulls you into missing a broken backend.

See what your users really get. Explore website monitoring →