Most delivery incidents reduce to a small set of questions: is this the edge or the origin, is the cache doing what you think, and what changed. This page maps common status codes and symptoms to causes and lists the evidence to collect before you escalate. It complements Logs and observability.
Status code meanings at the edge
| Code | Meaning in a delivery context | Usual cause |
|---|---|---|
| 402 Payment Required | Entitlement or subscription check failed | Paywall, expired plan, payment state |
| 403 Forbidden | Access policy refused the request | Geo restriction, token failure, referer or bot rule |
| 404 Not Found | Object absent at edge and origin | Purged object, wrong path, missing origin file |
| 410 Gone | Object intentionally removed, permanently | Takedown, consent or rights revocation |
| 5xx | Edge or origin failed | Origin down, timeout, misconfigured rule, capacity |
402 and 403 are often working as designed. Before treating them as bugs, confirm the access policy that produced them. 410 is the right code for content removed for consent, likeness, or legal reasons: it tells clients and crawlers the removal is permanent, unlike 404, which implies the object might return. If you need the removal cached at the edge so it survives until purges propagate, make sure the rule caches 410 deliberately.
Stale content
A viewer sees an old segment, manifest, or page after a change. Work through the layers:
- Cache key and TTL. If the key includes a parameter that did not change, the edge may be serving an older variant. See Cache control and cache keys.
- Purge propagation. A hard purge must reach every region; a soft purge marks objects for revalidation and can serve stale briefly by design.
- Browser and player caches. Confirm the response headers you send, not just the edge state.
- Live manifests. A manifest is supposed to be stale within seconds; if it is minutes old, the packaging or TTL is wrong, not the network.
Low offload
Byte offload drops and origin egress climbs. The usual suspects, in order:
- Cache-key fragmentation — a per-viewer token, session ID, or analytics parameter entered the key.
- TTL too short or origin sending
no-store. - Range misses —
206requests falling through to origin instead of being served from cache. - Rules shadowing each other — a broad rule placed above a specific one. See Rules and path policy.
- A recent config change — compare against the last known-good plan.
Cache deception symptoms
Cache deception is when an attacker tricks the cache into storing a personalized or authenticated response under a URL that looks static, then reads it back without authorization. Watch for:
- Requests where a dynamic URL is dressed with a static extension (
/account/1.json,/profile/x.css). - Personalized responses being cached because the rule matched on extension alone.
- Discrepancies between what the origin considers the path and what the cache key uses.
Defend by normalizing the path before cache decisions, never making cacheability a function of extension alone, and ensuring authenticated responses are uncacheable or keyed correctly. Cache-key hygiene and access policy are the same design problem.
Isolating edge from origin
Establish where the fault is before changing anything.
- Read
Cache-Status(RFC 9211) or the edge’s hit/miss field to see if the response came from cache. - Request a cache bypass to force an origin fetch and compare.
- Compare regions and POPs — if one region fails, it is not a global config bug.
- Fetch the origin directly with the correct
Hostheader to confirm the origin’s own response. - Check for a
CDN-Loop(RFC 8586) if requests appear to cycle. - Line up the timeline against the last apply, purge, or certificate change.
Evidence to collect
Before escalating, capture: the full request and response headers, the Cache-Status value, the trace ID (traceparent), timestamp with timezone, region or POP and ASN, the exact reproducible URL including range, cache key if visible, and matching origin logs. A single reproducible request with headers beats a screenshot of a dashboard.
Where AdultInfra fits
AdultInfra helps teams build the alerting and evidence trail that turns these incidents into short, mechanical investigations, and tunes cache and access policy so the common failure modes do not recur. Bring a reproducible request and your logs to contact us, or start with Adult video CDN.