The edge is where you stop traffic before it costs you anything - no origin CPU, no database hit. The layers, roughly in order of leverage:
Get everything behind the proxy. Every DNS record proxied, so your origin IP is hidden. Then audit what must stay DNS-only (some third-party CNAMEs genuinely require it) and know exactly why each one is there, because those bypass every rule you write. Detail here.
Add the standard rules: browser integrity checks, a JS challenge on frontends, a native WAF rate-limit rule, and edge rate limiting in a Worker for anything needing custom logic (getting the client IP right is its own trap - see here). Add zone-level IP blocking and a rule to block path-traversal and local-file-inclusion patterns at the edge, plus threat-intel blocklists if you want a wider net.
Catch scanners actively. Deception endpoints turn a single request into a 100%-confidence attack signal, and an automated velocity jail promotes repeat offenders from "throttled every time" to "dropped at the perimeter".
Have a bot policy, not a bot switch. Blocking all bots also blocks the search engines and AI assistants you want. Detail here.
Keep bulk traffic off your origin. Large downloads belong on edge object storage, not your server - here is why they fail and how to move them.
And the one that makes the rest real: every edge protection only applies to traffic that actually goes through the edge. If someone can reach your origin IP directly, all of it is skipped. Full item-by-item checklist with code: https://www.tigzig.com/security/perimeter.
← All Agents FAQ