Network diagram

The diagram below shows how requests flow through the Cloudflare network when Smart Shield is active, and where each feature applies along that path.

Requests from visitors first reach a nearby lower-tier data center. For static (cacheable) content, the lower-tier checks its local cache. On a cache miss, the request moves to an upper-tier data center — selected by Smart Tiered Cache based on lowest latency to your origin. If Regional Tiered Cache is configured, a regional hub is checked before the upper-tier. Persistent storage through Cache Reserve provides a final cache layer before requesting content from your origin.

For dynamic (non-cacheable) requests, Argo Smart Routing finds the fastest network path to your origin. Between Cloudflare's upper-tier data centers and your origin, connection reuse packages multiple requests into a single connection, reducing the total number of connections your origin handles.

Health Checks run from multiple data centers to monitor whether your origin is online and responsive. Dedicated CDN Egress IPs provide reserved IP addresses for traffic from Cloudflare to your origin, allowing you to restrict your origin firewall to a small allowlist.