FOUNDATION
Life of a request: eyeball to origin and back
The client path on top, the ordered FL2 pipeline below. A HIT is answered at the edge; only a MISS travels on to origin, and every stage is observable in tracing.
User / eyeball
Browser opens a connection to your hostname.
Cloudflare edge · FL2 L7 proxy
Anycast to the nearest colo, TLS termination, then the ordered pipeline below.
Origin
Reached only on a cache MISS or DYNAMIC request.
Anycast + TLS
MISS · DYNAMIC
HIT · Served from edge
Response · optimize · compress · cache · deliver
Inside FL2 · ordered request pipeline
Deterministic order · each stage is observable in tracing
01
DDoS
L3/L4/L7
02
Security Rules
WAF · Rate Limit · Managed
03
Bot Mgmt
Score & challenge
04
Rules
Transform · Config · Redirect
05
Cache
Edge · Tiered · Regional
06
Workers
Custom logic · fetch
07
Load Balancing
Endpoint pools · Steering
Security Rules collapses WAF custom rules, rate limiting and managed rulesets into one phase. Full ordering: developers.cloudflare.com/fundamentals/reference/traffic-sequence.
Cloudflare Application Performance04