Fastly

Overview

Fastly is a publicly traded edge cloud company (NYSE: FSLY) that sells a programmable platform for content delivery (CDN), edge compute, application security, and real-time observability. Primary job: put caching, request logic, and protection close to users so APIs, media, publishing, and e-commerce sites stay fast under load—with configuration that can update network-wide in seconds rather than waiting on classic multi-minute CDN rollouts.

Company site: fastly.com. Pricing: fastly.com/pricing. Docs: fastly.com/documentation and developer.fastly.com. Status: fastlystatus.com. Trust/compliance: fastly.com/compliance.

Architecturally, Fastly runs a relatively small number of high-capacity points of presence (POPs) rather than tens of thousands of micro-PoPs—software-defined control and high cache density over micro-PoP sprawl. Marketing stats (mid-2026) cite on the order of 578 Tbps edge capacity, more than 5 trillion daily requests, and regional mean Instant Purge™ under 150 ms (company-reported; measure your own regions).

The platform spans four product families: Network Services (CDN, TLS, Image Optimizer, streaming/Media Shield, load balancing), Compute (Wasm-based serverless formerly branded Compute@Edge, plus KV/Secret stores, Fanout/WebSockets, Object Storage, AI Accelerator), Security (Next-Gen WAF powered by Signal Sciences tech, DDoS, bot/API/client-side protection), and Observability (real-time logging, Edge Observer, Domain/Origin Inspector, Log Explorer).

Key features

• Full Site Delivery (CDN) — HTTP caching with fine-grained control over TTLs, stale-while-revalidate/stale-if-error patterns, shielding (origin offload via a designated shield POP), compression, HTTP/3 & QUIC, and multi-region bandwidth billing. Aimed at HTML, APIs, and dynamic personalization—not only static assets.
• Instant Purge & surrogate keys — Global invalidation marketed at under ~150 ms regional mean. Soft purge (mark stale) vs hard purge; URL purge, purge-all, and surrogate-key purges (often recommended for bulk invalidation). Critical for newsrooms, catalogs, and headless CMS workflows that cannot wait multi-second or multi-minute purges.
• VCL (Varnish Configuration Language) — First-class programmable edge for classic CDN services: request/response manipulation, routing, A/B tests, auth gates, and caching policy without spinning containers. Power users praise flexibility; newcomers face a learning curve versus Cloudflare-style UI rules.
• Compute (Wasm) — Compile Rust, JavaScript, Go, and related toolchains to WebAssembly; run sandboxed request handlers at the edge on Wasmtime. Use cases: auth, personalization, geofencing, SEO, templating, API glue, and full edge apps. Access edge primitives: data stores, dynamic config, messaging. Free tier includes substantial request and vCPU-ms allotments (see Pricing).
• Edge data: KV Store, Config Store, Secret Store, Object Storage — Durable key-value at the edge; config maps for non-secret settings; secrets for credentials; S3-compatible Object Storage marketed with zero egress fees for Fastly delivery paths (confirm current product terms when designing cost models).
• Image Optimizer — On-the-fly transforms (resize, format conversion, quality) billed per image request with a free tier and volume steps down to very low unit rates at hyperscale.
• Streaming & media — Live streaming and VoD paths, On-the-Fly Packager, Media Shield for multi-CDN origin efficiency—common for broadcasters and high-traffic video publishers.
• Security stack — Next-Gen WAF (Signal Sciences lineage; agent, reverse-proxy, and edge deployments), automated DDoS Protection, Bot Management, API Security, Client-Side Protection, AI bot scraping controls, edge rate limiting. Company claims a high share of WAAP customers run in blocking mode (marketing cites ~90% historically).
• TLS at scale — Managed TLS (nonprofit CA / BYO certs / Certainly), commercial CA options, mutual TLS—domain-based monthly pricing after free domain allotments.
• Real-time logging & metrics — Stream logs to major backends; Edge Observer dashboards; optional Domain/Origin Inspector and Log Explorer for paid observability depth.
• Developer tooling — Fastly CLI, Terraform provider, open SDKs and starter kits on GitHub, Academy courses, MCP Server product for AI-assisted service control, free trial/signup path without mandatory enterprise sales for usage tier.
• AI Accelerator — Semantic caching layer for LLM API traffic to reduce repeated model calls (request-metered free + paid tiers).

Pricing

Fastly is primarily usage-based with a free developer tier, optional fixed packages for Network Services / Compute / Observability / Security, and custom enterprise quotes. Numbers below are from the official pricing page as researched mid-2026. Accounts created before November 4, 2025 may still be on legacy pricing—always verify in your billing UI.

Product (usage)	Free included	Paid example (first paid band)	Notes
Full Site Delivery bandwidth	100 GB / month (all regions free band)	NA/EU ~$0.12/GB (100 GB–10 TB); Asia/AU/SA ~$0.19; India/Africa/Korea higher (~$0.28)	Next 10 TB steps down (e.g. NA/EU ~$0.08/GB). High volume: contact sales.
Delivery requests	1 million free	~$0.01 per 10k requests (1M–100M); then ~$0.0095	Billed per region per month on request meters.
Compute requests	10 million free	~$0.50 per 1M (10M–500M), declining to ~$0.20 at extreme volume	Plus separate vCPU time meter.
Compute vCPU-ms	100 million free	~$0.05 per 1M vCPU-ms after free, declining at volume	Bill both requests and CPU time for heavy handlers.
Image Optimizer	100,000 free image requests	~$0.50 per 10k (100k–10M), steep volume discounts	Can dominate bills for image-heavy sites without caching discipline.
TLS domains	5 free (managed nonprofit CA / Certainly)	~$20/domain beyond free; commercial CA ~$275/domain; mTLS flat ~$500 beyond 2 free	Multi-tenant / multi-brand sites add up.
DDoS Protection	500k free requests	From ~$1.00 per 10k after free, volume discounts	Separate from Next-Gen WAF packaging.
Object Storage	5 GB free	~$0.02/GB; Class A/B ops metered	Marketed with zero egress for edge access paths.
KV Store	1 GB free + op free bands	~$0.50/GB storage; Class A/B ops in $ per 100k/1M	Edge-state workloads need both storage and op forecasts.
AI Accelerator	20,000 free requests	~$0.40 per 1k requests (20k–2M), then lower	Semantic cache for LLM backends.

Network Services packages (fixed monthly commitments; intended for web pages/APIs, not streaming; package rules cap African/Indian/South Korean billing regions at about 10% of traffic):

Package	List price	Requests / mo	TLS domains	Image Optimizer	Support
Basic	$1,500/mo	100M	20	30M image requests	Standard
Starter	$6,000/mo	500M	40	150M image requests	Gold
Advantage	Contact sales	2B	80	800M image requests	Gold
Ultimate	Contact sales	5B	150	2.5B image requests	Enterprise

Compute packages: Starter $500/mo (500M requests, 5B vCPU-ms, 20 services, 5 config stores); Advantage/Ultimate contact sales (2B / 5B request bands; Ultimate adds large KV capacity and op allotments).

Observability packages: Starter from $1,500/mo (500M requests) bundling Edge Observer, Origin/Domain Inspector, Alerts, and Log Explorer & Insights; Advantage/Ultimate contact sales.

Security packages (Core / Core Plus / Total): Next-Gen WAF, DDoS, bots, API, and client-side capabilities with workspace/custom-rule limits—list prices are sales-quoted, not pure self-serve meters. Standalone Bot Management, Next-Gen WAF, Client-Side Protection, API Security, and AI Bot Management are also contact-sales on the usage page.

Other published meters (usage page, mid-2026): Fanout free band 100M minutes + 50M messages; WebSockets free 100M minutes; Secret Store 10 secrets free then ~$5/secret; Domain Research API free 10k status checks then per-request pricing. Always re-check fastly.com/pricing—accounts created before November 4, 2025 may still be on legacy pricing.

Limits & gotchas

• Price vs Cloudflare free tier — Community consensus (r/devops, r/CloudFlare): Fastly is rarely the cheapest for hobby/static sites. Value shows up for real-time invalidation, advanced edge logic, multi-CDN media, and ops-heavy enterprises.
• VCL learning curve — Extremely powerful; not “click a WAF rule and go” for every team. Compute (Wasm) is the modern language path but has its own SDK/runtime constraints and dual metering (requests + vCPU-ms).
• PoP density trade-off — Fewer, fatter POPs can mean excellent cache hit ratios and TTFB on well-cached content, but last-mile geography differs from Cloudflare’s denser footprint. Always measure your audience regions.
• Package geographic constraints — Network Services packages document limits (e.g. no more than ~10% of traffic from Africa, India, or South Korea billing regions on those packages). Global consumer apps need careful region modeling.
• Single-provider outage risk — The June 8, 2021 global incident (~1 hour; latent software bug triggered by a customer configuration) took down many major sites and remains the canonical HN/Reddit cautionary tale. Multi-CDN remains best practice for critical delivery.
• Security packaging opacity — Next-Gen WAF and full bot/API suites often require sales quotes; self-serve free/usage security surface is thinner than the enterprise story.
• Streaming vs web packages — Don’t assume a web Network Services package is licensed for heavy video; Media Shield / streaming products are the intended path.
• Legacy vs new pricing — Pre–Nov 4, 2025 online accounts may still be on legacy meters—migrations can change unit economics.
• Not a full app host — Fastly is edge + security + delivery. You still need origins (object storage, Kubernetes, PaaS, hyperscaler). Compare carefully against all-in platforms like Vercel or Netlify if you want Git-to-URL hosting.

Community sentiment

Across r/fastly, r/devops, r/aws, r/CloudFlare, and Hacker News, Fastly’s reputation is premium programmable CDN: loved by teams that need Instant Purge and deep edge control; debated when the bill is compared to Cloudflare.

Praise: sub-second (often sub-200 ms) global purge as a product differentiator for publishers and commerce; VCL expressiveness for caching what “dumb CDNs” struggle with (HTML, personalized APIs); Compute/Wasm cold-start marketing and open standards story; strong enterprise support anecdotes; Next-Gen WAF (Signal Sciences heritage) regarded as developer-friendly with lower false-positive pain than classic regex WAFs; analyst recognition (Gartner Peer Insights Customers’ Choice narratives for edge/WAAP categories; Forrester Edge Development Platforms leadership messaging in 2026 materials).

Criticism: list bandwidth often higher than Cloudflare or budget CDNs for the same GB; sales-gated security SKUs; June 2021 outage still cited as concentration risk; VCL skill gap for teams used to Workers/UI rules; some HN debates over fair performance comparisons versus Cloudflare Workers; hobbyists often told “just use Cloudflare free.” r/devops pricing threads frequently re-run the math: a few TB on Fastly list rates can look steep versus Cloudflare Pro/Business all-you-can-eat framing—defenders counter that cache hit ratio, Instant Purge, and support SLAs change the effective cost for dynamic sites.

G2 and Gartner Peer Insights scores cluster high (mid–high 4.x depending on product slice) with themes of performance, purge, and support—and cost predictability as the recurring knock. 2025–2026 CDN roundups place Fastly as the real-time/dynamic specialist, not the default free CDN. Backblaze B2 ↔ Fastly free-egress threads also surface as a cost path for storage-heavy delivery.

Who should use it

• Digital publishers & newsrooms that invalidate breaking content constantly and measure Instant Purge as a workflow requirement.
• E-commerce & catalog APIs needing aggressive caching of semi-dynamic content with precise surrogate-key invalidation.
• Streaming/media platforms using Media Shield, live/VoD packaging, and multi-CDN origin efficiency.
• Platform teams that want VCL or Wasm edge logic as infrastructure-as-code (CLI, Terraform, CI) with real-time logs.
• Security-conscious orgs consolidating WAAP (Next-Gen WAF + DDoS + bots) with edge delivery and compliance needs (SOC 2 Type 2, ISO 27001, PCI DSS Level 1 SP, GDPR/HIPAA documentation paths).
• Developers prototyping edge apps on the free Compute + CDN tiers before committing to packages.

Who should pause: pure static brochure sites optimizing only for $0; teams unwilling to learn VCL/Compute; workloads that need the densest last-mile footprint without measuring; orgs that want an all-in-one frontend cloud rather than edge in front of their own origins.

Alternatives

• Cloudflare — Usually cheaper entry, denser global network, aggressive free tier, Workers + R2 + Zero Trust bundle; different edge programming model. Common Reddit default for startups and hobby sites.
• AWS CloudFront (+ WAF, Lambda@Edge / CloudFront Functions) — Best when origins and IAM already live in AWS; purges and config velocity historically lag Fastly’s Instant Purge story.
• Akamai — Enterprise breadth and media footprint; often heavier sales/ops process; Fastly positions as more developer-programmable.
• Vercel / Netlify — Frontend clouds with built-in CDN; better Git preview DX, less raw multi-origin CDN control.
• Render or self-host + budget CDN (Bunny.net, KeyCDN, CDNsun) — Simpler app hosting or lower $/GB when you don’t need Instant Purge-class control or VCL depth.
• Google Cloud CDN / Azure Front Door — Hyperscaler-native paths when multi-cloud or Microsoft/Google estates dominate.

Verdict

Fastly remains a leading programmable edge cloud for teams that treat the CDN as software: Instant Purge, VCL and Wasm Compute, real-time logging, and a serious WAAP stack (Signal Sciences–powered Next-Gen WAF). The free tier (100 GB delivery, 1M requests, generous Compute free bands) is enough to evaluate; production web packages start in the low thousands per month, while pure usage billing scales with regional GB, requests, images, and security add-ons.

Bottom line: Choose Fastly when cache invalidation latency, edge programmability, media multi-CDN, or enterprise WAAP integration are competitive advantages—and budget accordingly versus Cloudflare’s free/Pro economics. Measure TTFB and hit ratio on your traffic mix, instrument spend by product meter on day one, design multi-CDN failover for critical properties (lessons from 2021 still apply), and use Compute or VCL deliberately rather than treating Fastly as a drop-in static host. For many Next.js/git-first apps, pair or compare with Vercel/Netlify; for AWS-native estates, shortlist CloudFront; for pure cost at hobby scale, Cloudflare usually wins—Fastly wins when control and purge semantics are the product.