Origin shield and offload testing

Origin offload is the percentage of total requests that the CDN cache serves instead of your origin. It is the main efficiency metric for a CDN deployment. A 95 % offload rate means only 1 in 20 requests touches your origin, and your infrastructure costs and MTTR under traffic spikes drop in proportion. This page shows how to measure that percentage with MaxoPerf and how to verify that your origin protection holds up when the cache is cold or under stress.

What origin shield is

Many CDNs offer a multi-tier architecture with a shield (also called a mid-tier or parent cache) between edge nodes and the origin. On a cache miss, edge nodes ask the shield first instead of going straight to origin. If the shield has the object, it serves it, and origin only ever saw one request. If the shield misses, it fetches from origin once and stores the response for all later edge requests.

The result:

• Origin request rate drops sharply, especially during purge events or sudden traffic spikes.
• Fewer edge-to-origin round trips. Only the shield-to-origin leg needs to be fast.
• Origin connection count stays manageable. Even with hundreds of edge nodes, origin never sees more simultaneous connections than the shield opens.

Providers use different names. CloudFront calls it Origin Shield, Fastly calls it Shielding, Akamai has Tiered Distribution, and Cloudflare has Argo Tiered Caching.

Before you start

• Check whether origin shield is enabled for your CDN configuration. Most providers make it an opt-in setting per distribution or service.
• You need a way to measure origin request rate outside MaxoPerf. This usually means your origin’s access logs, a Prometheus/CloudWatch metric, or your CDN’s own analytics. MaxoPerf measures end-to-end response metrics from the load runner’s side. It cannot directly see the origin request count.
• Run a warm-cache baseline test before this test so you know your expected hit ratio.

Measuring offload percentage

You calculate origin offload from two numbers:

• Total requests: all requests the CDN receives (from MaxoPerf or real users).
• Origin requests: requests that pass through to your origin (cache misses + uncacheable requests).

Offload % = (1 - origin_requests / total_requests) × 100

MaxoPerf generates the total requests. Your origin telemetry measures how many reach the origin. A properly instrumented test compares the MaxoPerf run total with your origin access log count for the same time window.

Quick smoke check with curl

Run a manual check before a full load test:

# First request — expect MISS (origin fetch)
curl -sI https://cdn.example.com/static/app.js | grep -i 'x-cache\|age\|cf-cache'
# Expected: X-Cache: Miss from cloudfront

# Second request — expect HIT (served from cache)
curl -sI https://cdn.example.com/static/app.js | grep -i 'x-cache\|age\|cf-cache'
# Expected: X-Cache: Hit from cloudfront

# If origin shield is in the path:
# First miss:  edge → shield (miss) → origin
# Second miss: edge → shield (hit) — origin NOT touched

Load test pattern: origin under cache-miss pressure

This test generates cache misses on purpose to put the origin under pressure. It is the worst case for offload:

execution:
  - concurrency: 200
    ramp-up: 1m
    hold-for: 5m
    scenario: origin-pressure

scenarios:
  origin-pressure:
    default-address: https://cdn.example.com
    requests:
      # Append a unique query string to bust the cache on every request.
      # Use this only in controlled testing — never in production.
      - label: cache-busted-request
        url: /static/app.js?cb=${__time()}
        method: GET
        assert:
          - equals:
              subject: http-code
              value: '200'

Caution

A cache-busting parameter (?cb=<timestamp>) makes every request miss the cache and reach origin. This test directly measures your origin’s throughput capacity and error rate under high concurrency. Run it only against a staging origin or during a maintenance window with spare capacity.

After this test, compare:

• Origin request rate (from your origin logs). Without shield, it should approach 200 req/s.
• Origin request rate with shield enabled. It should be far lower, because the shield absorbs repeated misses for the same URL.

Load test pattern: warm cache, then measure origin residual

This pattern checks real-world offload for cacheable assets:

execution:
  # Phase 1: warm the cache with a small amount of traffic
  - concurrency: 5
    hold-for: 2m
    scenario: warm-pass

  # Phase 2: full load — measure how little reaches origin
  - concurrency: 500
    ramp-up: 1m
    hold-for: 10m
    scenario: warm-load

scenarios:
  warm-pass:
    default-address: https://cdn.example.com
    requests:
      - url: /static/app.js
        label: warm-js
      - url: /static/styles.css
        label: warm-css

  warm-load:
    default-address: https://cdn.example.com
    requests:
      - url: /static/app.js
        label: js-bundle
        assert:
          - contains:
              subject: headers
              value: 'X-Cache: Hit'
      - url: /static/styles.css
        label: css-bundle
        assert:
          - contains:
              subject: headers
              value: 'X-Cache: Hit'

During Phase 2, origin traffic for the static assets should be near zero. Any origin requests in your origin logs are cache misses, usually from edge nodes that had not yet cached the warm response.

How to read origin offload results

When analysing MaxoPerf results for origin offload tests:

Signal	What it means
Zero assertion failures on X-Cache: Hit	Cache is holding under load. Offload is working.
Assertion failures rising under higher VU count	Requests bypass the cache, and origin receives more misses than expected.
5xx errors in Log tab	Origin fails under the miss rate. Enable shield or add origin capacity.
TTFB bimodal distribution (fast + slow cluster)	The cache serves some requests (fast) and origin serves others (slow). Normal during ramp-up, and it should clear as the cache warms.
Elevated TTFB persisting through entire run	High miss rate for the whole run. Check Cache-Control headers, TTL configuration, and cache-key correctness.

Shield tier testing

To verify that origin shield works:

1. Enable shield in your CDN configuration for the test distribution.
2. Run the cache-busted origin pressure test above.
3. Watch origin request rate. With shield enabled it should be a fraction of the rate without shield (often 1/N where N is the number of edge nodes).
4. Disable shield and repeat. The increase in origin request rate confirms the shield’s contribution.

Tip

If your CDN provider shows shield hit/miss metrics in its analytics dashboard, line them up with the MaxoPerf run timeline. A shield hit rate above 95 % during steady-state traffic is a healthy baseline for a well-configured CDN.

Do / don’t

Do:

• Always compare origin request rate (from origin logs) with total request rate (from MaxoPerf). It is the only way to measure the actual offload percentage.
• Test with shield enabled and disabled to measure how much the shield protects origin.
• Run origin pressure tests against a staging environment first to find the origin’s breaking point before you run in production.

Don’t:

• Assume a high MaxoPerf hit rate (low TTFB) equals high origin offload. A CDN may return fast responses from a regional cache while other regions send heavy traffic to origin.
• Enable cache-busting parameters in production tests. They bypass the cache on purpose and could destabilise your origin.
• Skip monitoring origin error rate on its own. MaxoPerf shows what the CDN returns to load runners. Origin errors that the CDN hides from runners (e.g. by serving stale content on origin error) do not appear in MaxoPerf results.

Where to go next

• Cache invalidation and purge testing: origin protection under purge events.
• Multi-region edge performance: how shield tiers interact with geographic distribution.
• Cache hit/miss testing: verify the cache is warm before origin offload tests.
• TTFB and asset delivery: the latency breakdown between edge and origin legs.