Blog

A second CDN looks like insurance until the first invoice arrives. Priced band by band on Bunny's published Volume ladder, 2 PB a month costs at least 20% more split evenly across two accounts than on one — 38.5% more if you take the 1–2 PB rate from Bunny's marketing page rather than its documentation. The ratio you send to the second provider sets your bill, your cache hit ratio and your real failover time at once. This article settles how to pick it.

What a multi-CDN strategy actually is

A multi-CDN strategy delivers the same content through two or more CDN providers, with a steering layer deciding which one serves each request. It is built three ways: DNS-based steering, client-side selection inside the player or application, and manual failover by changing a record when something breaks. They differ in how fast they react and in what they can measure.

DNS steering is the common choice because it needs no application change; Cloudflare's Load Balancing documentation, for example, lists five global steering policies — Standard, Geo, Dynamic, Proximity and Least Outstanding Requests (Cloudflare, 2026). Client-side selection reflects real delivery performance, because the player measures what the user got, but it requires you to own the client.

The decision most teams skip is not which mechanism, but what share of traffic the second provider carries in steady state. That number reorders every other answer below.

The split ratio sets the bill, and the worst ratio is 50/50

CDN volume pricing is a descending ladder. Where it is applied band by band to one monthly total — which is how the published labels read ("First 500 TB", "Next 10 TB"), although neither Bunny page states the method — splitting the traffic restarts each provider's meter at the top band. Because the marginal rate falls as volume rises, the penalty on two identical ladders is largest at the even split, the configuration that looks most redundant.

The table isolates the effect by pricing one published ladder against itself, one account against two. A real second vendor has a different ladder, so read it as the mechanism, not a quote.

Rates: bunny.net/pricing/cdn, bunny.net/docs/cdn/pricing and fastly.com/pricing, all read 15 October 2026. Bunny's two pages disagree on the 1–2 PB band, so both rows are shown. Fastly bills "per GB per Region per month"; its free first 100 GB is included.

Three things fall out of that table no single provider will say.

Below the first band boundary, splitting is free. At 500 TB both halves stay inside Bunny's first Volume band, so the split costs nothing. Tier dilution only exists once your single-provider volume has crossed a discount boundary — so below that point the cost argument against a second CDN does not apply.

The cheapest split is the one that protects you least. At 2 PB, moving from 50/50 to 90/10 cuts the premium from 20.0% to 5.3% on the documentation rate (38.5% to 9.2% on the marketing rate), and 95/5 cuts it to 2.7% (4.6%). Every point saved there comes from traffic taken away from the provider you are paying to keep warm.

Above a certain volume the comparison stops being possible. Fastly's public rate card ends after the "Next 10 TB" band, with "Contact us for high-volume pricing" above the table; Bunny's Volume ladder ends at "2 PB+" with "Contact us". A multi-CDN plan at real scale is a negotiation, and the published cards are only your opening anchor. Before assuming the split is cheap, see how to cut CDN costs before you add a second provider.

Failover is slower than your TTL, and lowering the TTL makes it worse

DNS-based CDN failover is not instant. Detection takes the health-check interval multiplied by the retry count — Cloudflare's own monitor documentation works an example in which five retries at a 20-second timeout mark an endpoint unhealthy "after approximately 120 s (6 × 20 s)" — and the record change then has to outlive every resolver cache still holding the old answer.

The instinct is to cut the TTL to 30 or 60 seconds. Measurement data says that makes the tail worse rather than better. Bhowmick et al. measured 27,131 resolvers across 9,514 autonomous systems. At a 60-minute TTL, 0.31% of the resolvers tested extended it; as the test TTL was lowered step by step to one minute, the share rose to 8.74% of the resolvers measurable from at least five vantage points. The authors estimate the effect reaches "at least 38% of the popular websites that use CDNs" (Bhowmick et al., PAM 2023).

So the shortest TTL you set is not the longest wait you get. Close to one in eleven of the resolvers measured extended a short TTL, which keeps their users on a CDN you have already pulled from rotation. Plan the failover window as detection plus TTL plus a non-compliant tail.

The standby cache is the cost nobody quotes

Each CDN maintains its own cache. A provider carrying 5% of your traffic sees 5% of your request volume, which means the long tail of your catalogue is never resident in it. When you fail over, you do not move traffic onto a warm CDN. You move it onto a cold one, and every miss becomes an origin fetch.

The arithmetic is unforgiving because miss rate, not hit rate, is what the origin feels. Fastly's engineering team puts it plainly: "If your CHR increases from 90% to 95%, it's not merely a 5% improvement; it actually halves your origin load" (Fastly, 2024). Run that backwards. A standby whose hit ratio starts at 50% instead of a steady-state 95% delivers ten times the origin fetch volume of the provider it just replaced — at the exact moment you are already in an incident.

Fastly's shielding case study shows the scale in production: with shielding, one customer's origin load was "capped well below 5GiB/s"; without it, at a similar hit ratio, it settled "in the low 20GiBs range," which Fastly describes as 4x the shielded load (Fastly, 2024). Shielding suppresses that, and shielding is per-vendor — provider B's shield cannot read provider A's cache. Two CDNs means two independent fill paths against one origin.

That is the hidden cost of a multi-CDN strategy: it appears on neither CDN invoice. It lands on your origin egress bill. If your origin sits in a hyperscaler, see cloud egress fees comparison for what those fetches cost per GB.

What breaks in production

• The cold standby turns a CDN incident into an origin incident. The failure mode is not that the second CDN is slow. It is that your origin saturates while it fills. Load-test the failover at real traffic, not at 1%.

• Shielding inflates the miss count you monitor on. Fastly documents that "a request that does reach your origin server will be counted as two misses, one at the edge, and one at the shield." Fastly adds that this "will result in a cache hit ratio (CHR) that may be lower than you expect" — enabling shielding can make the reported hit ratio look worse while origin load falls. Judge it on origin bytes, not on CHR.

• Anycast routing can move you into a more expensive billing region. Fastly's billing documentation states that Anycast IPs "will route a request to the nearest POP located in a billing region that may charge a higher rate." Two providers means two independent region maps, and traffic you believed was European can be billed otherwise at one of them.

• Package terms can carry geographic caps. Fastly's Deliver packages carry the footnote "No more than 10% of traffic may originate in the African, Indian, or South Korean billing regions." A steering policy that shifts traffic by latency can walk a contract into breach without anyone reading the clause.

• You cannot attribute a failure without a per-response identifier. When a user reports a broken session, nothing in a standard response says which CDN served it. CTA-5006, Common Media Server Data, defines response headers that give "a uniform method for media servers and services to communicate data about media objects," and AWS Elemental MediaPackage uses its n key for "The identifier for the MediaPackage origin endpoint of this object" (AWS, 2026). Without an equivalent header or log field at every provider, a multi-CDN incident review is guesswork.

Measure these seven things before you split traffic

1. Your single-provider monthly volume against your current ladder. Find the next band boundary. Below it, tier dilution is zero and the cost objection does not apply to you.

2. Origin egress over 30 days, in bytes, not requests — the number a second cache will increase.

3. Cache hit ratio by content class — hot catalogue versus long tail. The long-tail ratio is what the standby will actually deliver on day one.

4. Health-check detection time end to end: interval × retries, measured, not assumed. Then add your TTL.

5. Resolver behaviour on your own zone. Change a record, then watch the decay curve of requests to the old target. That tail is your real failover window.

6. A parallel run. Serve a sampled share of live traffic through the candidate provider for a full week including a weekend peak, and compare delivered performance from the client rather than from either vendor's dashboard. CDN optimization: cache hit ratio, TTL and origin load covers the measurement setup.

7. Your contracts. Minimums, commitments, region caps and the overage rate above the published card — for both providers, in writing, before the split.

Choosing the ratio

Three questions decide it, in order.

Is your volume past a discount boundary? If not, choose the split on resilience grounds alone. If it is, price 50/50, 90/10 and 95/5 against your actual ladder first — at 2 PB on Bunny's ladder, the gap between 50/50 and 95/5 is 17 to 34 percentage points.

Can your origin survive the standby filling at full traffic? If not, give the second provider a higher steady-state share, paid for as cache warmth, not redundancy. A 5% standby is a 5% guarantee.

Can you attribute a failure to a provider within one incident? If not, build that before the second CDN, not after. A multi-CDN setup you cannot debug is two vendors blaming each other.

Read together, the three sections above point one way: a single well-chosen provider with shielding beats a badly-split pair, and a share chosen deliberately — priced against your ladder and tested against your origin — beats both a default 50/50 and a reflexive 95/5. We buy across providers rather than for one, so the split ratio is a configuration choice here, and one invoice covers every provider in the test. Bring us 30 days of volume, origin egress and hit-ratio figures and we will price the split three ways before you commit to either vendor — see how our data delivery service handles multi-provider sourcing. If you are splitting because one provider is exiting, the CDN shutdown migration playbook sequence applies first.

FAQ

Does a multi-CDN strategy always cost more?

Not always. Below your provider's first discount boundary, splitting traffic costs nothing extra, because both halves stay in the same band. Above it, the penalty grows with volume and peaks at an even split — on Bunny's published Volume ladder, 11.1% at 1 PB a month and 20% to 38.5% at 2 PB, depending on which Bunny page you price from.

How fast is multi-CDN failover in practice?

Slower than the TTL suggests. Detection takes the health-check interval times the retry count, and Cloudflare's documentation gives roughly 120 seconds for six 20-second attempts. The record change then has to expire in every resolver cache, and measurement data shows a minority of resolvers extend short TTLs beyond their stated value.

Should I lower my DNS TTL to speed up failover?

Within limits. A 2023 study of 27,131 resolvers found 0.31% extending a 60-minute TTL, rising to 8.74% as the test TTL was lowered to one minute, so very short TTLs increase the share of resolvers that hold your record longer than instructed. A short TTL shortens the median failover and lengthens the tail.

What traffic share should the second CDN carry?

Enough to keep its cache representative of your catalogue, which for most workloads is more than the 5% a hot-standby design implies. Measure your long-tail hit ratio at the candidate share during a parallel run; if it is far below your primary's steady state, the standby is not yet a standby.

Does multi-CDN increase origin load?

Yes. Each provider fills its own cache independently and each vendor's shield is private to that vendor, so the same object can be fetched from origin twice. The effect is largest on long-tail content and shows up on your origin egress bill rather than on either CDN invoice.

Can I run multi-CDN without changing my application?

Yes, with DNS-based steering, which is why most teams start there. The tradeoff is measurement: DNS steering decides from health checks and routing data rather than from what the user actually received. Client-side selection reacts to real delivery performance but requires you to control the player or application.

Most Hetzner vs OVH comparisons line the two up on monthly price. That leaves out the line that hits first: the setup fee. Since Hetzner’s 15 June 2026 price adjustment, its dedicated setup fee works out to about half of one month’s rate — €49.00 on a €97.30 AX42-1, €799.00 on a €1,597.30 AX162-3 (Hetzner Docs). OVHcloud charges a full month: Advance-3 is €199.99 a month with a €199.99 installation fee on its European site, and $255 with $255 on its US site — where, and only where, the fee is included on a twelve-month commitment (OVHcloud). For anyone who will not keep a server for a year, that difference reorders the comparison.

The fee as a share of the rate

Both providers publish a monthly rate and a one-time fee. Neither publishes the number that compares across them: the fee as a share of the rate.

On Hetzner’s price-adjustment page, the standard dedicated configurations carry setup fees between 47.4% (SX65-2) and 50.4% (AX42-1) of the monthly rate. On OVHcloud, every Advance and Scale listing we could read — European and US — shows an installation fee equal to one full month.

Spread over the time you keep the server, the fee becomes a premium on the monthly rate, and it shrinks as 1/N:

Premium = setup fee ÷ (monthly rate × months). Hetzner AX42-1: €97.30/month + €49.00 setup. OVHcloud Advance-3 2024: €199.99 + €199.99 (EU, excl. VAT) or $255 + $255 (US). The machines are not equivalent hardware, so only the fee structure is compared here. INXY.hosting charges no setup fee and has no minimum term.

Two things follow. Below twelve months, Hetzner’s entry cost is about half of OVHcloud’s. At twelve months and beyond, the setup fee shrinks to a few percent of the bill on either provider — at which point the monthly rate, not the fee, decides the comparison. So tenancy length decides the entry cost; it does not decide which provider is cheaper overall.

One caveat on OVHcloud’s waiver. The US Advance FAQ states: “The setup fees for your dedicated server are included for any commitment period of 12 months or longer.” The European Advance page lists the same one-month fee and says nothing about commitment. If you are buying in Europe — where Hetzner’s dedicated servers are — do not assume the waiver applies; get it on the order form before signing the term that is supposed to buy it.

Which is cheaper to set up, Hetzner or OVHcloud? Hetzner’s dedicated setup fee is about half of one month’s rate. OVHcloud’s installation fee equals one full month; its US site includes it on commitments of twelve months or longer, while its European site does not mention a waiver. Below twelve months, Hetzner costs less to start.

What each one charges to start

Hetzner sells from three inventory pools with three fee structures — not three tiers of one product.

Hetzner: price-adjustment page (created 15 June 2026, last changed 8 July 2026) and Server Auction FAQ. OVHcloud: European and US Advance pages and US price page. Prices excl. VAT. All read 12 October 2026.

The -LTD setup fee is nearly flat. €39.00 applies across most of the pool — 50.5% of a month on the €77.30 AX42-1-LTD, 12.3% on the €317.30 AX162-1-LTD. Two models (AX41-1-LTD and EX44-1-LTD) carry €0.00, and three step up: EX131-2-LTD to €49.00, DX182-1-LTD to €51.00 and SX295-1-LTD to €59.00. Hetzner sells the pool while supply lasts, so repeat orders are not assured — but on a one-off order the larger server has the smaller relative entry cost.

The Server Auction has no setup fee at all. Hetzner’s FAQ: “There are no setup fees for these servers,” and “The cancellation period for these servers is usually immediately.” These are “old” servers re-listed after a previous customer cancelled, “designed for people who already have experience in server administration.” For a short load test it is the zero-entry-cost option on either vendor.

Bandwidth: both say unlimited, and they mean different things

Hetzner meters only the faster port. Its traffic documentation: “All root servers have a dedicated 1 GBit uplink by default and with it unlimited traffic,” while “Inclusive monthly traffic for servers with 10Gbit uplink is 20TB,” charged at “€ 1 ($1.20)/TB for overusage.” Only outbound traffic counts: “We do not count incoming and internal traffic.” The AX42 product page confirms it: traffic “is unlimited and free of charge,” except on servers with the 10G uplink add-on. The upgrade turns an unmetered service into a metered one — see metered vs unmetered bandwidth.

OVHcloud does not meter, with one regional exception. Its US bandwidth page says “Our bandwidth is unlimited and unmetered across all dedicated servers,” with no exception on that page. The US Advance FAQ adds one: unmetered traffic applies “with the exception of solutions and services hosted in our Asia-Pacific data centers.” For a server in Singapore, Mumbai or Sydney, ask for the traffic terms in the quote.

Guaranteed throughput differs by range, not just by vendor. OVHcloud’s European Advance page lists “3Gbps unmetered and guaranteed public bandwidth”; its US Advance page lists 1 Gbps unlimited public bandwidth, upgradable to 5 Gbps. Hetzner’s AX42 lists a 1 Gbit/s port with 1 Gbit/s guaranteed. On the Advance range, OVHcloud guarantees more.

For ingest-heavy work — backup targets, log sinks, replication receivers — Hetzner’s outbound-only rule keeps inbound free even on a metered 10G uplink, and OVHcloud counts nothing outside Asia-Pacific. Both work; the dedicated server pricing line items decide more than port speed.

Where each one physically is

Location rules providers out rather than reordering them, so it is where the comparison should start.

Hetzner: location labels from the price-adjustment page (US and Singapore appear only under cloud servers); SLA from Hetzner’s Cloud SLA document. OVHcloud: sites from the global availability page; commitments from the US Dedicated Server SLA (effective 6 January 2025). Read 12 October 2026.

A two-country footprint suits one buyer and rules out another. For EU data residency it is simple and defensible. For a latency target in North America or Asia it ends the conversation.

The SLAs are not symmetric. OVHcloud’s US SLA pays service credits of 10%, 30% or 100% of the monthly fee as availability drops below the commitment, below 99.00% and below 95.00%, excluding one-time fees and capped at 100% of the month. Hetzner’s published SLA covers Cloud servers and vServers at 99.9%; we found no dedicated-server equivalent. Treat it as unpublished rather than absent, and ask for it in writing.

For Asia-Pacific, confirm in the quote. OVHcloud’s global availability page marks Rise, Advance and Scale at all three APAC sites, while the APAC traffic exception above applies there. Confirm range, site and traffic terms before ordering.

Contracts, generations and repricing

Hetzner’s commercial shape is short. The AX42 page states “No minimum contract term” and “Cancellation period: immediately.” You pay about half a month to start and can leave the same day, which makes it a natural home for anything exploratory.

OVHcloud’s shape is the mirror image — on its US site. There the commitment buys the fee waiver, so the cheapest entry is also the longest lock-in. For a workload already sized for years, that is a fair trade; for one still being measured, it turns an experiment into a term contract.

Hetzner reprices on change, not on renewal. “For orders placed before 15 June 2026, but delivered after 15 June 2026, the previous prices will apply,” and “certain changes to servers with legacy pricing may trigger a switch to the current pricing.” Your cheapest server is your oldest one, and a consolidation that touches it can move that capacity onto current rates. Model fleet changes at today’s prices.

OVHcloud model names outlive their hardware. The US price page lists 2024 and 2026 Advance ranges under the same names, on different processors:

OVHcloud US price page, read 12 October 2026; the 2026 listings are marked “Coming Soon”. The European page shows the same pattern: Advance-1 2024 at €114.99, 2026 at €159.99 (+39.1%).

These are different machines, not a price rise on the same one — Advance-5 even changes CPU vendor. A quote for “Advance-5” without a generation year could describe either server. Put the generation and CPU model on the order.

A third option: no setup fee, no minimum term

The trade-off above — a cheap, flexible entry or a committed, waived one — is a feature of these two providers’ pricing, not of dedicated hosting. INXY.hosting dedicated servers have no setup fee and no minimum term, so the entry premium in the first table stays at 0% whatever the tenancy.

• No setup fee — the entry premium is 0% at every tenancy length

• No minimum term — leave when the workload ends

• Matched-spec quotes on request, priced next to the published Hetzner and OVHcloud rates

• Pay in fiat or crypto

What breaks in production

1. The commitment was meant to buy the waiver, and the order form did not say so. The fee sits on the price card unconditionally; the waiver lives in an FAQ — and only on OVHcloud’s US site. Reconcile them before signing.

2. The 10G uplink was ordered for headroom and arrived with a meter. A 1 Gbit Hetzner port is unlimited; the 10 Gbit add-on is 20 TB, then €1/TB.

3. Backup and replication were sized against the wrong direction. Hetzner counts outgoing traffic only, so a replication target receiving 40 TB and serving 2 TB bills on the 2 TB. Check the direction rule per product.

4. The APAC server inherited European terms in the plan but not in the contract. Unmetered on the bandwidth page, excluded in the Advance FAQ.

5. The short-tenancy server was bought from the standard range. A six-week load test there pays a ~50% setup premium that the Server Auction or a zero-fee -LTD model would not.

6. The fleet consolidation repriced the survivors. Changes to grandfathered Hetzner servers can move that capacity onto current pricing.

Seven steps before you order

1. Write down the tenancy in months. If the honest answer is “we do not know”, treat it as under twelve.

2. Decide the region first. Hetzner’s dedicated range is Germany and Finland only.

3. Divide the one-time fee by the monthly rate, then by your tenancy. That is the entry premium, comparable across vendors and currencies.

4. Compare monthly rates on matched hardware. Above twelve months, this decides the bill.

5. Measure traffic in both directions for 30 days before choosing an uplink.

6. Get three things in writing: the installation-fee condition, the per-TB rate above any allowance, and the uptime commitment with its credit mechanism.

7. Write the exit before the entry. Immediate cancellation and a committed term cost very different amounts for the same change of mind.

Which one when

Is Hetzner cheaper than OVHcloud? Published monthly rates do not settle it, because the two vendors’ configurations are not like-for-like. Entry cost can be compared: Hetzner’s setup fee is about half a month, while OVHcloud’s is a full month, included on twelve-month commitments only on its US site.

The decision, framed

Can you name the region? If the workload needs a dedicated server in North America or Asia-Pacific, Hetzner is out.

Can you name the tenancy? Under twelve months, Hetzner’s entry cost is about half of OVHcloud’s, and the Server Auction or a zero-fee -LTD model takes it to zero. Above twelve months, the setup fee fades and the monthly rate on matched hardware decides.

Can you sign for it? A commitment on hardware you have not sized is the most expensive line in this article. If the tenancy question has no number, choose an option you can leave without paying for the entry twice.

Most buyers asking this are choosing between a flexible entry and a committed one, and these two providers sit at opposite ends of that trade. If you would rather not choose, INXY.hosting dedicated and bare-metal servers have no setup fee and no minimum term. Send us your target configuration and an honest tenancy estimate, and we will price it side by side with the published Hetzner and OVHcloud rates. Leaving a hyperscaler? Start with what cloud egress actually costs.

FAQ

Does Hetzner charge a setup fee?

Yes, on the standard dedicated range. Since the 15 June 2026 price adjustment it is about half of one month’s rate — €49.00 on a €97.30 AX42-1, €799.00 on a €1,597.30 AX162-3. Server Auction servers carry no setup fee, and two -LTD models, AX41-1-LTD and EX44-1-LTD, are listed at €0.00.

Is OVHcloud’s installation fee avoidable?

On OVHcloud’s US site, yes: its Advance FAQ states the setup fees are included on any commitment of twelve months or longer. Its European Advance page lists a one-month installation fee without mentioning a waiver. Confirm the condition on your order form either way.

Is Hetzner traffic really unlimited?

On the default 1 Gbit uplink, yes — unlimited, counted outbound only. Servers with the 10 Gbit uplink add-on include 20 TB per month, then €1 ($1.20) per TB. The faster port is the metered one.

Does OVHcloud meter bandwidth?

Outside Asia-Pacific, no. Its bandwidth page describes traffic as unlimited and unmetered across all dedicated servers, while its US Advance FAQ excludes services hosted in Asia-Pacific data centres. For Singapore, Mumbai or Sydney, ask for the applicable terms.

Which has better uptime guarantees, Hetzner or OVHcloud?

OVHcloud’s US dedicated-server SLA commits 99.95% for Advance, 99.99% for Scale and 99.90% for Rise and Game, with credits of 10%, 30% or 100% of the monthly fee. Hetzner’s published SLA covers Cloud servers and vServers at 99.9%; we found no dedicated-server figure.

Is there an alternative without setup fees or minimum terms?

Yes. Hetzner’s Server Auction and two -LTD models have no setup fee but limited stock. INXY.hosting dedicated servers have no setup fee and no minimum term.

Two teams store 100 TB of the same video library on Storj’s Regional Workflows tier, at the same published $10/TB rate. One pays $1,000 a month, the other $5,000. The only difference is how much they read back. Most comparisons of S3 alternatives sort vendors by storage price per terabyte — and for many workloads that column decides the smaller part of the bill. This article shows which number actually decides it, and how to measure yours before you sign.

The number that decides this is a ratio, not a rate

Divide your monthly egress volume by your stored volume. A 100 TB archive serving 10 TB a month is a 0.1× workload. The same 100 TB feeding a video player at 500 TB a month is a 5× workload. Nothing else about the two workloads differs, yet almost every vendor in this market prices them differently.

The reason is structural. Storage per terabyte is close to a commodity, so object storage vendors compete on how much read traffic they will absorb at that price. “No egress fees” is a real differentiator — and also a bet on your ratio, which each vendor has placed at a different number.

What is an egress ratio in object storage? The egress ratio is your monthly download volume divided by your stored volume. A 100 TB bucket serving 300 TB a month has a 3× ratio. Many “free egress” offers are capped at a multiple of stored data — commonly 1× or 3× — while a few have no cap at all, so the ratio, not the storage rate per terabyte, decides which provider is cheapest for a given workload.

Four offers, four definitions of “free egress”

Wasabi charges nothing for egress, and its pricing FAQ draws the line at a ratio of one: the free-egress policy fits workloads whose monthly egress is “less than or equal to your active storage volume”. There is no overage rate. If usage regularly exceeds the policy, Wasabi says it may “limit or suspend your service” (Wasabi pricing FAQ).

Cloudflare R2 states: “There are no charges for egress bandwidth for any storage class.” There is no ratio; R2 earns on operations instead, at $4.50 per million Class A and $0.36 per million Class B requests on Standard storage (Cloudflare R2 pricing).

Storj includes 1× egress on its Global Collaboration and Regional Workflows tiers and charges $0.02/GB and $0.01/GB above it. Its cheapest tier, Active Archive at $6/TB, includes no free egress and charges $0.02/GB from the first byte (Storj pricing, updated 15 July 2026).

INXY.hosting S3 includes egress up to 3× your average stored data each month and charges $0.015/GB above it. Egress to our CDN partners CacheFly and Gcore is free and unlimited.

Read side by side, these offers implement four different rules — 1×, 3×, unlimited, and no free egress at all on the cheapest archive tier — and one of them enforces its limit through an account-level right to limit or suspend service rather than an overage price. A commercial term you cannot convert into a line item is not a price; it is a risk, and it belongs in your vendor review as well as your cost model.

Published rates, side by side

All rates from each vendor’s own published page, read 9 October 2026; currencies as published, prices before tax, no FX applied. Hetzner’s included quota is defined in TB-hours and scales with month length, which is why its included traffic runs from 1.008 TB (28 days) to 1.116 TB (31 days). Hetzner’s rates are taken from its price list as of October 2026. DigitalOcean prices in GiB, so its per-TB figure is about 7% lower than the same number in decimal units.

The worked example: same 100 TB, two ratios, different winners

Take 100 TB stored. First at a 0.1× ratio — 10 TB egress a month, a backup target or a compliance archive — then at 5×, an ordinary month for a media library or a dataset read by training jobs.

Arithmetic from the published rates above at 1 TB = 1,000 GB, 30-day month, storage and egress only. Amazon S3 uses the standard us-east-1 internet egress tiers ($0.09/GB first 10 TB, $0.085 next 40 TB, $0.07 next 100 TB, $0.05 above 150 TB). R2 read requests add $0.36 per million GETs — tens of dollars a month for a typical video library. The CacheFly / Gcore row covers storage and storage egress only; delivery from the CDN to viewers is billed under the CDN plan.

Four things follow from the table.

Against Amazon S3, every alternative wins — by a margin that depends on the ratio. At 0.1× the alternatives cost roughly a fifth to two-thirds of the S3 bill. At 5×, where S3’s metered egress dominates, the cheapest alternatives cost about a twentieth of it. The ratio decides not only which alternative wins, but how much moving off S3 is worth.

Between a 3× plan and an unlimited one, the ranking inverts. At 0.1×, INXY.hosting S3 is cheaper and R2 costs 1.5× as much ($1,500 against $999). At 5× served directly from storage, R2 is cheaper and the 3× plan costs 2.7× as much. The crossover is calculable: $9.99/TB with 3× free egress and $15/TB above it equals R2 at $15/TB when egress reaches 3.33× stored volume. Below that ratio the 3× plan is cheaper; above it unlimited egress is — unless delivery runs through a CDN whose egress from storage is free, which removes the overage line altogether.

The lowest storage rate does not guarantee the lowest bill. Storj Active Archive has the lowest storage rate in the table, $6/TB, but at 0.1× it only ties with Wasabi ($800 against $799) because every byte of egress is billed, and at 5× it is the second most expensive option after S3.

The cheapest number on the list comes with the tightest ceilings. On Hetzner’s current price list, both scenarios are the lowest direct-from-storage prices in the table even after converting euros to dollars (about €636 and €1,126). But Hetzner caps a bucket at 100 TB and 750 requests per second, and bills small objects as 64 kB. The 100 TB in this example fills one bucket exactly. Cheap and constrained is a valid choice; it is a different choice from cheap and elastic.

Wasabi needs its own sentence. Its storage line is among the cheapest at 0.1×, and at 5× there is no number to put in the table: a 5× workload sits outside the policy the product is sold under. That is not a criticism — the fit is clearly stated — but it means comparing a published price with an absent one. Treat any “no egress fees” claim as a question: free up to what multiple, and above it, a rate or a conversation?

Minimum billable object size: the second bill nobody models

Storage rates assume your objects are large. Three providers above publish a minimum billable object size, and the numbers differ by a factor of 25: Wasabi bills a minimum of 4 KB per object, Hetzner 64 kB, and Storj 50 kB on its Global and Regional tiers and 100 kB on Active Archive. INXY.hosting S3 has no minimum billable object size.

Take 100 million objects averaging 10 KB — thumbnails, map tiles, log shards, feature vectors, small JSON documents. That is 1 TB of real data.

The cheapest archive rate in the market produces the most expensive bill for this workload. Storj Active Archive at $6/TB bills 7.5× what Wasabi charges at $7.99/TB for the identical byte count, because a 10 KB object is billed as 100 kB. Storj Regional at $10/TB bills five times what INXY.hosting S3 charges at $9.99/TB, for the same reason. All of these numbers sit on the vendors’ own public pages, one click from the headline rate.

Request pricing compounds in the same direction. Writing those 100 million objects once costs about $445 in Class A operations on R2 after its 1 million free monthly requests, against nothing on INXY.hosting S3, Hetzner and Scaleway, where those calls are free or included. On an ingest-heavy, small-object workload the request line can exceed the first month of storage — then fall to near zero, which is why it rarely appears in an estimate built from a steady-state month.

“S3-compatible” is a spectrum — and the gaps are in the vendors’ own docs

Every provider here speaks the S3 API. None implements all of it, and the gaps are documented plainly enough that there is no reason to discover them during a cutover.

Cloudflare R2. The compatibility page states “Feature implementation is currently in progress” and marks as not implemented: bucket versioning, object tagging, bucket policies, replication, public access blocks, website configuration and object lock. ACL headers and SSE-KMS headers are unsupported; only the STANDARD and STANDARD_IA storage classes are implemented. On multipart uploads, if a retry to the same part number fails, the earlier part is lost and must be re-uploaded (Cloudflare R2 S3 API compatibility). The missing object lock matters for anyone using object storage as an immutable backup target.

Hetzner publishes hard ceilings: up to 100 TB and 50,000,000 objects per bucket, 750 requests per second and 10 Gbit/s per bucket, and 100 buckets per account (Hetzner Object Storage docs). Amazon’s performance guidance is at least 3,500 PUT/COPY/POST/DELETE or 5,500 GET/HEAD requests per second per prefix, with no limit on the number of prefixes in a bucket (AWS S3 performance guidelines). These are different units — per bucket versus per prefix — but that is the point: on S3 you scale request rate by adding prefixes; on a per-bucket ceiling, you can only add buckets, up to the account cap.

That is the migration risk the price tables never carry. A storage rate is reversible in a month. An architecture that assumed versioning, object tags, object lock, bucket policies or prefix-level scaling is not.

Is S3-compatible object storage the same as Amazon S3? No. S3 compatibility means a provider implements the S3 API, not all of it. Cloudflare R2, for example, documents bucket versioning, object tagging, object lock and replication as not implemented. Check each provider’s compatibility page against the specific operations your application calls.

What breaks in production

• Minimum storage duration on short-lived objects. Wasabi Pay as You Go has a 90-day minimum: an object stored on day 1 and deleted on day 16 is billed 15 days of active storage and 75 days of deleted storage (Wasabi, updated 14 September 2026). Storj Active Archive has a 30-day minimum; R2 Infrequent Access has a 30-day minimum plus $0.01/GB retrieval. A job that writes and expires temporary objects daily pays for each of them for a month or a quarter.

• The minimum can depend on your contract. Wasabi publishes 90 days for Pay as You Go, but says other pricing models have different minimums and directs customers to sales or support for the figure. If you buy on a contract, get the number in writing before signing.

• Included quotas do not accumulate. Hetzner: “Unused included quota expires at the end of each month and cannot be carried over to the next month.” A quarterly restore is three months of unused allowance followed by one month of overage.

• GiB and GB are mixed across the market. DigitalOcean prices in GiB; most of the market prices in decimal TB. The 7.4% gap lands on both the storage and the egress line.

• Egress policies are enforced against sustained behaviour, not peaks. A one-off restore is unlikely to matter; a permanent change in read pattern after you point a CDN at the bucket is a different conversation. With a CDN in front, the ratio the storage vendor sees is your cache-miss volume — which makes cache hit ratio a storage cost input, not only a performance metric.

• Self-hosting an S3 API needs an owner. In December 2025 MinIO put its open-source community edition into maintenance mode — no new features or pull requests, security fixes assessed case by case — and pointed users towards MinIO Enterprise (InfoQ, 2025), after earlier removing admin features from the community web console. Whatever comes next, a self-hosted comparison row needs a named owner, a patch process and a maintenance budget.

Measure these seven things before you shortlist anything

1. Pull 90 days of egress and stored volume from your current provider’s billing export, not a monitoring dashboard. Compute egress ÷ stored for each month and take the highest, not the average.

2. Count objects and get the size distribution — specifically the share below 4 KB, 50 kB, 64 kB and 100 kB, the published minimum billable sizes in this market.

3. Count write operations separately from reads. On R2, PutObject, CreateMultipartUpload, UploadPart, CopyObject and ListObjects are Class A — a listing-heavy application is priced like a write-heavy one.

4. List every S3 operation your code and tooling actually call, including backup agents and SDK defaults, and check each candidate’s compatibility page. Versioning, tagging, object lock, ACLs, bucket policies, SSE-KMS and POST pre-signed uploads are the usual casualties.

5. Measure peak request rate and throughput per bucket and check them against each candidate’s per-bucket ceiling and per-account bucket cap.

6. Price the exit as well as the entry. Moving data in is an egress event at your current provider; moving it out later is one at the new provider. See the cloud egress fees comparison for the regulatory changes now starting to waive exit charges.

7. Run a parallel write for two weeks against the top two candidates before cutting over reads. That bill is the only estimate not built on assumptions.

How to decide

Three questions, in this order.

What is your peak monthly egress ratio? Below about 1×, the storage rate dominates and most providers in the table are viable — sort on price, limits and compatibility. Between 1× and about 3.3×, a 3×-included plan is usually cheapest, and 1× models are either metered or outside their policy. Above about 3.3×, unlimited egress beats a 3× plan served directly from storage — or put a CDN with free storage egress in front of the 3× plan. Either way, request pricing becomes your next question.

What is your median object size? Under about 100 kB, minimum billable object size can outweigh everything else in the storage column and reorder the table. Above about 1 MB it is irrelevant. Check it rather than assume it: object counts are usually dominated by small objects even when bytes are not.

What does your application assume the API will do? If the answer includes versioning, object lock, object tags, bucket policies or prefix-level request scaling, the compatibility matrix — not the price — is your shortlist.

The three answers often point at two providers rather than one, and that is a useful outcome: an archive tier priced for low egress and a delivery tier priced for high egress can beat a single compromise on both lines.

Where INXY.hosting S3 storage fits

INXY.hosting S3-compatible object storage costs $9.99 per TB a month. Egress up to 3× your average stored data is included; above that it is $0.015/GB. Egress to our CDN partners CacheFly and Gcore is free and unlimited. There is no minimum billable object size, API requests are included, and you can pay in fiat or crypto.

On the egress-ratio curve, that fits most workloads up to about 3× — backups, archives, datasets and application storage — and, with delivery through CacheFly or Gcore, high-ratio media and download workloads where the storage-side egress line would otherwise dominate the bill.

If you want the arithmetic run against your own numbers, send us 90 days of stored volume, egress volume, object count and request counts. We will show you what the same workload costs on INXY.hosting S3-compatible object storage next to the published rates above — including the cases where another option fits better.

Related reading: 95th percentile vs metered bandwidth billing on when backup ingest is billable at all; GPU server hosting on why moving a training corpus is an egress event priced by the storage side; and the CDN migration playbook for the cutover sequence when delivery moves with the data.

FAQ

What is the cheapest alternative to Amazon S3?

It depends on your egress ratio. At 100 TB stored and 10 TB monthly egress, a 3×-included plan such as INXY.hosting S3 costs $999 a month and Cloudflare R2 $1,500. At 500 TB monthly egress served directly from storage, R2 stays at $1,500 while the 3× plan reaches $3,999 — unless delivery runs through a CDN partner with free storage egress. Hetzner’s list price is lower at both ratios but comes with 100 TB and 750 requests-per-second limits per bucket. Compute your own ratio first.

Does “no egress fees” mean unlimited downloads?

Not always. Wasabi’s policy covers egress up to your active storage volume and reserves the right to limit or suspend accounts that regularly exceed it. 3×-included plans such as INXY.hosting S3 meter egress above three times stored volume. Cloudflare R2 charges no egress at any volume but meters requests instead.

Is S3-compatible storage a drop-in replacement for S3?

Not without checking. Cloudflare R2 documents bucket versioning, object tagging, object lock, bucket policies and replication as not implemented, and every provider publishes its own list of gaps. List the S3 operations your application calls, then verify each one against the provider’s compatibility page.

Why is my object storage bill higher than the per-terabyte rate suggested?

Usually minimum billable object size or minimum storage duration. Storj bills at least 50 kB per object on its Regional tier and 100 kB on Active Archive, Hetzner 64 kB, Wasabi 4 KB — so 10 KB objects can bill as 5 to 10 times their real volume. Wasabi Pay as You Go also has a 90-day minimum storage duration, and Storj Active Archive a 30-day one.

Should we self-host object storage instead?

It can make sense for high-ratio workloads, but it is now a staffed option. MinIO’s community edition moved to maintenance mode in December 2025, so the assumptions behind the most common default have changed. Budget an owner, a patch process and a tested restore before comparing it on price.

How many object storage providers should we use?

Two is common and often cheaper than one. An archive tier priced for low egress and a delivery tier priced for high egress can beat a single compromise provider on both lines, provided the application can address two endpoints. The overhead is one more set of credentials and one more compatibility matrix.

Latitude.sh prices a bare-metal NVIDIA H100 80 GB at $1.68 an hour or $1,230 a month. Multiply the hourly rate by the 730 hours in an average month and you get $1,226.40 — the monthly plan costs $3.60 more than running the same server by the hour all month. Cherry Servers, meanwhile, takes about 19% off an A40 if you commit to the month.

Both are honest rate cards, and the difference between them is the most useful thing to understand before you sign for GPU capacity: the higher you go up the GPU range, the less a commitment buys you in price — and the more it buys you in access. This piece works through the published numbers and what they mean in practice.

What a GPU dedicated server costs, from published rate cards

Every figure below comes from the provider’s own public page, read on 5 October 2026; the Latitude.sh, Hetzner and OVHcloud figures were re-checked on 7 October 2026. Currencies are as published, Hetzner prices exclude VAT, and no FX has been applied. “Break-even hours” is the monthly price divided by the hourly price — the number of hours a month above which the monthly plan becomes cheaper than paying by the hour.

Sources: Hetzner pressroom (GEX131), Cherry Servers dedicated GPU servers page, Latitude.sh pricing, OVHcloud GPU dedicated server page, Atlantic.Net dedicated GPU hosting. Only the Hetzner announcement carries a date.

Two things follow from the table.

The commitment discount narrows as the hardware gets more in demand. About 19% on an A40, 14.5% on Hetzner’s workstation-class RTX PRO 6000 Max-Q, about 4% on an A100, and nothing on Latitude.sh’s H100, RTX PRO 6000 and B300 nodes. It is not a clean rule — Hetzner still discounts a current-generation Blackwell card — but the direction is consistent.

Headline prices for the “same” GPU are not comparable until you normalise the service. $1,230 and $4,729.44 are both “H100-class” servers, but one is a self-managed H100 80 GB billed by the month and the other is a managed H100 NVL on a 12-month term with a security stack and support included. The gap is management, support and contract terms, not silicon.

Why the monthly discount shrinks on top-tier GPUs

On Cherry Servers’ own card, the mid-range accelerators (P4, A2, A10, A16) and the A40 all break even at 583–590 hours — a consistent 19–20% discount for a monthly commitment. The A100 breaks even at 702 hours, 96% of the month, for a 3.9% discount. On Latitude.sh’s 8x RTX PRO 6000 and 8x B300 nodes the monthly price is the hourly rate multiplied by exactly 730, to the dollar: there is no monthly discount, only a monthly-sized invoice.

A monthly discount is the provider paying you to take idle-capacity risk off its hands. Where cards can sit unrented, that is worth paying for. Where every unit is allocated as soon as it comes online, the provider carries no idle risk and has no reason to discount. That matches what we see in our own inventory: H200 and B300 capacity is taken as fast as it is installed, while workstation-class cards such as the RTX A4000, RTX A5000 and the RTX PRO series are where availability — and room on price — still exist.

One practical check before you treat any monthly figure as a discount: ask how it is applied. On some offers the monthly price is a separate term with a minimum commitment; on others it works more like a ceiling on hourly billing. The break-even arithmetic is the same either way; the cost of leaving early is not.

Is it cheaper to rent a GPU server monthly or hourly? It depends on the GPU and on how many hours a month the server is allocated to you. On published 2026 rate cards, a monthly commitment saves roughly 19–20% on mid-range cards such as the A40, about 4% on an A100, and nothing on some providers’ H100, RTX PRO 6000 and B300 nodes, where the monthly price equals the hourly rate times 730.

Long-term contracts: read what is being reserved

Multi-year contracts follow the same logic as monthly ones, only more visibly.

Vultr publishes per-GPU on-demand rates next to prepaid contract rates. On the NVIDIA L40S, on-demand is $1.671/GPU/hr and 36-month prepaid “starts at $0.848/GPU/hr” — a 49.3% discount. On the AMD MI300X, $1.850 against a 24-month prepaid rate from $1.750 — 5.4%. On HGX H100, 36-month prepaid starts at $1.490/GPU/hr, so a long enough term still buys a lower rate there. But on AMD’s newest parts the published numbers point the other way: MI325X is $2.000 on demand and from $2.100 on 24-month prepaid; MI355X is $2.590 on demand and from $2.650 on 48-month prepaid. Vultr’s page quotes prepaid rates as “starts at” and does not say the configurations are identical, so read this as a signal — long-term pricing on the newest accelerators is not built around discounting — rather than proof that prepaying costs more for the same server.

Lambda shows the same shape on a different product line. Its on-demand NVIDIA B200 SXM6 instance is $6.69/GPU/hr. Its 1-Click Clusters on HGX B200, sold on commitments of two weeks to one year, are $9.86/GPU/hr at 16 GPUs, $9.36 at 64 and $8.87 at 256+ — 33–47% above the on-demand rate (Lambda pricing page, checked 7 October 2026). These are different products: a cluster is interconnected multi-node capacity, an instance is a single server. Lambda reserves its “lowest prices” for terms over a year, which go through sales. The published commitment price, in other words, buys guaranteed interconnected capacity — not a discount.

The operational consequence: if you are quoted a long-term contract on top-tier GPUs at or near the on-demand rate, do not evaluate it as a discount. Evaluate it as the price of having the hardware at all, for a stated term. That is a different decision from a volume commitment on dedicated server pricing, where committing usually lowers the unit rate.

The line items the GPU price card does not show

Setup fees. On all four of OVHcloud’s GPU dedicated server configurations, the public page lists an installation fee equal to one month’s price: $1,145 on Scale-GPU-1, $1,180 on Scale-GPU-2, $1,216 on Scale-GPU-3 and $4,355 on HGR-AI-2. Without any adjustment, a twelve-month first year is a thirteen-month invoice — $56,615 rather than $52,260 on the HGR-AI-2, 8.3% above the headline. The page does not say whether a 12- or 24-month term changes the fee, so ask: the setup fee is one of the most negotiable lines in a bare-metal quote. Hetzner, for comparison, removed the GEX131 setup fee from 16 December 2025.

Egress. GPU workloads are usually described as ingest-heavy, which makes traffic allowances look generous. Inference is the opposite. Latitude.sh includes 20 TB out with inbound unmetered; Atlantic.Net includes 10 TB a month; Cherry Servers includes 30–100 TB depending on plan; Hetzner’s GEX45 page states traffic is “unlimited and free of charge”, though the GEX131 announcement does not state terms — confirm per model. A serving endpoint that returns images or audio will hit a 10 TB allowance much sooner than a training job. The rules are the same as for any bare-metal fleet — see metered vs unmetered bandwidth.

Power, if you own. The RTX PRO 6000 Blackwell Max-Q has a maximum power draw of 300 W (NVIDIA). At full load for 730 hours that is 219 kWh. At the EU average non-household electricity price of EUR 18.37 per 100 kWh in the second half of 2025 (Eurostat, 8 May 2026), the card alone costs EUR 40.23 a month — from EUR 16.38 in Finland (EUR 7.48/100 kWh) to EUR 55.89 in Ireland (EUR 25.52/100 kWh). That is the card only. A whole GPU server — CPUs, hundreds of GB of RAM, NVMe, fans, network — typically draws two to three times the card’s figure, and the facility adds its PUE on top. At 2.5 times the card and a PUE of 1.5, the bill is roughly EUR 150 a month, about 17% of the GEX131 rental price. Meaningful, but not what decides rent versus own. The capital does — and so does memory.

Memory, if you buy in 2026. TrendForce expects server DRAM contract prices to rise 13–18% quarter-over-quarter in 3Q26, noting that several US cloud providers have multi-year long-term agreements “which restrict suppliers from raising prices for these clients”, and that “the primary source of server DRAM price increases will shift toward customers without LTAs” (TrendForce, 9 July 2026). A GPU server carries hundreds of gigabytes of system DRAM. If you are buying one this year, you are most likely a customer without an LTA — the part of the market absorbing the increase. The provider renting you the same server may not be.

How to run the rent-or-own calculation

1. Measure allocated hours, not busy hours. Hourly billing on dedicated hardware runs from the moment a server is provisioned until it is released — not only while the GPU is computing. Busy hours lower your bill only if you actually release the server between jobs, and on top-tier cards you may not get it back. Track both over 30 days: allocated hours drive the bill; GPU-busy hours tell you whether you are oversized. Leaseweb’s guidance on sizing is blunt: “Below 50% means you are paying for capacity that sits idle” (Leaseweb, 2026).
2. Compare allocated hours with the break-even for your own quoted rates. Below it, hourly billing wins.
3. Price the full first year, not the monthly rate: setup fees, IP addresses, remote hands and any support tier that is mandatory for production.
4. Price egress at your real inference volume, not your training ingest.
5. Compare ownership over the hardware’s service life, typically three to five years: hardware, rack space and power, remote hands, spares and the engineering time to keep drivers and CUDA current. Twelve months of rent is a useful sanity check — EUR 10,668 for a GEX131, $14,760 for Latitude.sh’s single H100. If the hardware costs several times that, owning only pays off if you will run it hard for years — the same test behind most cloud repatriation decisions.
6. Check whether the GPU is available on demand at all. If it is not, you are in the capacity market and the comparison is access versus waiting, not price versus price.
7. Re-price at renewal. Every pattern above depends on current supply, and supply moves.

How many hours a month justify a monthly GPU server? Divide the quoted monthly price by the quoted hourly price. On the 2026 rate cards checked, break-even lands between 583 and 732 hours of a 730-hour month — roughly 80% to 100%, counted in hours the server is allocated to you, not hours the GPU is busy.

What breaks in production

The same spec sheet, two different GPUs. The RTX PRO 6000 Blackwell family ships in three variants with identical 96 GB GDDR7 ECC memory and maximum power of 600 W (Workstation Edition), up to 600 W configurable (Server Edition) and 300 W (Max-Q) (NVIDIA). Two providers can both list “96 GB RTX PRO 6000” and deliver materially different sustained throughput. Ask which variant, in writing, before benchmarking.

Reserved capacity left idle. A server reserved to guarantee availability costs the same whether or not the job is running. Reserved scarce capacity punishes idling harder than on-demand does.

Training-data egress discovered at cutover. Moving a training corpus out of object storage to a new GPU provider is an egress event priced by the storage side. Budget it from the cloud egress fees comparison before scheduling the move, and keep the corpus close to the accelerators — the argument for co-locating S3-compatible object storage with compute.

Driver and CUDA pinning on bare metal. A dedicated GPU server is yours to maintain, including the kernel-module, driver and framework chain. A working image on one hardware generation is not portable to the next without a rebuild.

Provisioning time treated as zero. Cloud GPUs appear in minutes. Dedicated servers with in-demand cards are often pre-order or waitlisted — Cherry Servers lists its A40 and A100 as pre-order and several other cards as waiting-list only. A plan that assumes same-day delivery of eight current-generation accelerators will slip.

One utilisation number for a mixed fleet. Averaging a training cluster at 95% with an inference fleet at 20% hides the fact that they need opposite billing models.

GPU servers at INXY.hosting

We split our GPU line the same way the market does. Every configuration below is a single-tenant bare-metal server — no virtualisation, no shared card.

Netherlands

Monthly starting prices for a single-GPU configuration in our Netherlands location.

NVIDIA H200 and B300. All GPUs are currently in use. Reserve your spot to get access as soon as one frees up. For large projects, please contact us directly.

North America

Bare-metal GPU servers are also available in North America. Contact our team for current configurations and pricing.

Order a GPU server, reserve an H200 / B300 or talk to our team

The decision, framed

Three questions, in this order.

Is the GPU you need available on demand, in the quantity you need? If not, you are buying capacity. A price at or above the on-demand rate is the cost of certainty; evaluate it as insurance with a stated term, and get the renewal rate in writing.

Are your allocated hours above the break-even on your own quote? If not, stay hourly. If they are, a monthly or longer commitment is defensible — worth around 19–20% on mid-range cards, often little or nothing on top-tier accelerators, and the difference is visible on the provider’s own page in two minutes of arithmetic.

Does owning beat renting over the hardware’s service life? If yes — and you have somewhere to rack it and someone to maintain it — owning can win over several years. But you are buying system memory in a market where, on TrendForce’s reading, buyers without long-term agreements absorb the price rises, so use this quarter’s component prices, not last year’s.

Most teams end up with a split: committed capacity for the steady baseline, hourly for the spikes. That works best when baseline and burst do not have to come from the same rate card. If you have 30 days of allocated-hours data and a target configuration, that is enough to run the break-even against current quotes — see our dedicated and bare-metal hosting.

FAQ

Is a monthly GPU dedicated server cheaper than paying by the hour?

Only above the break-even hours. On published 2026 rate cards, a monthly plan saves about 19–20% on mid-range cards such as the A40, 14.5% on Hetzner’s RTX PRO 6000 Max-Q server, about 4% on an A100, and nothing on some providers’ H100, RTX PRO 6000 and B300 nodes. Below roughly 80% of the month in allocated hours, hourly billing is usually cheaper.

What is the minimum utilisation that justifies a dedicated GPU server?

Divide the quoted monthly price by the quoted hourly price. Across the providers checked, break-even is 583 to 732 hours of a 730-hour month — roughly 80% to 100%. Count hours the server is allocated to you, not hours the GPU is busy: hourly billing runs until you release the server.

Why don’t long-term contracts on H100, H200 or B300 come with a big discount?

Because the hardware is in short supply. Providers discount commitments when they carry idle-capacity risk; on top-tier accelerators they rarely do. Some long terms still lower the rate — Vultr’s 36-month prepaid HGX H100 starts at $1.490/GPU/hr — but on the newest parts published commitment prices often sit at or above on-demand, as with Lambda’s B200 clusters at $8.87–9.86/GPU/hr against $6.69 for an on-demand instance. What the commitment buys is guaranteed access.

What is included in the price of a GPU dedicated server?

It varies sharply. Among the plans compared, included traffic ranged from 10 TB to unlimited, setup fees from zero to a full month’s price, and management from none to a full managed security stack — which is most of why one H100-class server costs $1,230 a month and another $4,729.44.

Does owning GPUs beat renting them?

Only if you will run the hardware hard over its three-to-five-year life and have somewhere to host and maintain it. Electricity matters but does not decide it — roughly EUR 150 a month for a single-GPU server at EU average prices. The capital cost and today’s memory prices are what decide it.

How much bandwidth does a GPU server need?

Training is ingest-heavy and usually fits within included allowances; inference that returns images, audio or video is egress-heavy and often does not. Size the allowance against serving volume, not training volume, and check whether the provider meters inbound traffic as well as outbound.

Most CDN optimization work starts by raising TTLs and stops when the hit-ratio chart looks better. Then the origin egress bill does not move. The cause is almost always the cache key: the CDN is storing dozens of near-identical copies of the same object, and every one of them misses on first request. This piece covers what actually controls origin load — key cardinality, revalidation, and tiering — and the order to fix them in.

Cache hit ratio is the wrong number to run on

Cache hit ratio counts requests. Your origin bill counts bytes. The two diverge the moment object sizes vary, which is every real catalogue.

‍

Fastly draws the distinction explicitly: origin offload is "the ratio of bytes served to end users that were cached inside the CDN (not fetched from the origin), over total bytes served to end users for the service" (Fastly blog, accessed 2026). One large video segment miss outweighs thousands of hits on thumbnails, and hit ratio will not show it. The same write-up documents a customer who disabled shielding: hit ratio stayed in the low 90s while origin load went from under 5 GiB/s to over 20 GiB/s. A metric that can miss a 4× change in origin load is not a control surface.

‍

There is also a scaling effect people get backwards. Moving hit ratio from 90% to 95% is not a 5% improvement — the miss rate goes from 10% to 5%, so origin requests are cut in half. The last few points hold all the money, which is exactly why header changes alone rarely buy them.

‍

What is CDN optimization? CDN optimization is the work of reducing how much traffic reaches your origin without serving stale or incorrect content. It has three levers: shrinking the cache key so fewer duplicate objects exist, setting freshness and revalidation headers so objects survive longer at the edge, and adding a tiered or shield layer so edge misses do not all reach origin.

‍

In our migration work the first thing we ask for is not the hit-ratio dashboard. It is origin egress in bytes per hour, split by content type. That number tells you whether the problem is fragmentation, expiry or catalogue shape, and those have different fixes.

The cache key decides everything TTL cannot

A cache key is the string the CDN hashes to decide whether it already has your object. Anything in it that varies per user, per campaign or per browser multiplies your stored copies and drives every copy through a first-request miss.

‍

Cloudflare's default key is the full URL including query string, plus the Origin header and the method-override and forwarding headers (x-http-method-override, x-forwarded-host, x-original-url and several others) (Cloudflare docs, accessed 2026).

‍

Know which half of the fix is gated. Sort query string, Ignore query string, Cache deception armor and Cache by device type are ordinary Cache Rules settings. What Enterprise buys is the custom cache key: selecting named query parameters to include or exclude, and adding headers, cookies, host or user attributes to the key (Cloudflare docs, accessed 2026). So canonicalising parameter order is a toggle on most plans; surgically keeping ?variant= while dropping ?utm_source= is not, and below Enterprise that job belongs in your application or a Worker.

‍

Here is what fragments a key in production, with the documented behaviour behind each:

‍

That is the specification. The platform you are on may not implement it, and this is the single most consequential divergence in the whole article.

‍

Cloudflare states it plainly: "By default, Cloudflare does not consider vary values in caching decisions." Vary values are respected only "when you configure the Cache Rules Vary setting, when Vary for images is configured, and when the vary header is vary: accept-encoding" (Cloudflare docs, accessed 2026). A response containing Vary: * always bypasses cache regardless of that configuration (Cloudflare docs, accessed 2026).

‍

Read what that means for the common case. If you shipped Vary: Cookie on a cacheable page and assumed it protected per-user content, it did not fragment the cache and it did not disable it — by default the header was ignored and one stored object was served to everyone. That is a cross-user content leak, not a hit-ratio problem, and it fails in the direction that ends up in an incident report. Only Vary: * gives you the bypass. Treat Vary as a correctness control you must explicitly enable per platform, not as something the origin can assert and trust.

TTL and revalidation are a negotiation with the platform

RFC 9111 fixes the precedence. A cache calculates freshness lifetime from s-maxage if it is a shared cache, then max-age, then Expires minus Date, and only then falls back to heuristics (RFC 9111 §4.2.1, 2022). Where heuristics apply and a Last-Modified header exists, the spec encourages "no more than some fraction of the interval since that time. A typical setting of this fraction might be 10%" (RFC 9111 §4.2.2, 2022).

‍

That precedence is the most underused lever on the list. Split the edge lifetime from the browser lifetime: hold an object at the edge for a day while browsers revalidate in five minutes, so a purge on publish reaches every user immediately and the origin still sees almost nothing.

‍

Which header does the splitting depends on the platform, and this is where vendor-agnostic matters. On Varnish-derived stacks, Surrogate-Control takes precedence over everything else: Fastly documents its order of preference as Surrogate-Control: max-age, otherwise Cache-Control: s-maxage, otherwise Cache-Control: max-age, otherwise Expires (Fastly docs, accessed 2026). Surrogate-Control is also stripped before the response reaches the browser, which makes it the cleanest way to say "one hour at the edge, one minute in the browser" without the browser ever seeing the edge value. Use Surrogate-Control where it is honoured and s-maxage where it is not.

‍

Platform defaults then sit on top of the spec, and they differ enough to matter:

That last row is the single most dangerous default in CDN configuration, and it is documented rather than hidden. It is also almost never mentioned in optimization guides, because it is a correctness risk rather than a performance tip.

‍

Freshness expiry then creates a second problem: a synchronised miss. Every edge holding a copy expires at roughly the same second and every one of them fetches. Your origin sees a periodic spike with no traffic change behind it.

‍

RFC 5861 solves that in one directive. stale-while-revalidate "indicates that caches MAY serve the response in which it appears after it becomes stale, up to the indicated number of seconds" (RFC 5861 §3, 2010), and stale-if-error allows a stale response when the origin returns 500, 502, 503 or 504 (RFC 5861 §4, 2010). AWS recommends supplementing max-age with both (AWS docs, accessed 2026).

‍

How do you improve CDN cache hit ratio? Reduce the cache key first: strip tracking parameters, normalise query string order and case, forward only named cookies and headers, and keep Vary to the smallest set. Then extend freshness with s-maxage and add stale-while-revalidate so expiry does not force a synchronous origin fetch. Enable a tiered or shield layer last.

‍

stale-if-error also converts a short origin outage into cached-content delivery rather than a 502 page. We treat it as an availability control, not a caching one, and it is the cheapest one available.

‍

Then check that your platform will actually honour it. Cloudflare documents that "the stale-if-error directive is ignored if Always Online is enabled or if an explicit in-protocol directive is passed", and that those directives "include a no-store or no-cache cache directive, a must-revalidate cache-response-directive, or an applicable s-maxage or proxy-revalidate cache-response-directive" (Cloudflare docs, accessed 2026). Read that carefully: on Cloudflare, the s-maxage you just added to extend edge lifetime disables stale-if-error on the same response. The two most commonly recommended directives in CDN optimization advice cancel each other out on one of the largest CDNs, and no guide that treats headers as portable will tell you. Pick one per platform — s-maxage where you want edge/browser split and Always Online is off, stale-if-error where availability during an origin outage matters more — or use Surrogate-Control on stacks that honour it and leave s-maxage off the response entirely.

‍

One more thing the bytes-not-requests thesis demands: a revalidation is not a miss. When an object goes stale and the origin answers a conditional request with 304 Not Modified, you paid one request and almost no bytes. That is why ETag and Last-Modified belong on every cacheable response, not just the ones you plan to soft-purge. A site with aggressive revalidation can show a mediocre hit ratio and an excellent egress bill at the same time, and it will look like a problem on the dashboard your vendor gives you.

Tiering and shielding beat every header change

If edge PoPs each fetch independently, one object costs you as many origin requests as you have caching locations. A tier in front of the origin collapses that.

‍

CloudFront states it directly: "When you use Origin Shield, all requests from all of CloudFront's caching layers to your origin come from a single location. CloudFront can retrieve each object using a single origin request from Origin Shield, and all other layers of the CloudFront cache (edge locations and regional edge caches) can retrieve the object from Origin Shield" (AWS docs, accessed 2026).

‍

Cloudflare's equivalent is Tiered Cache. Smart Tiered Cache, which picks a single closest upper tier per origin, is available on all plans; Generic Global Tiered Cache and Custom Tiered Cache topologies are Enterprise features, as is the Regional Tiered Cache middle layer on the Tiered Cache documentation (Cloudflare docs, accessed 2026). Verify this one against the live docs before you plan around it — Cloudflare is currently moving parts of the tiering stack under the Smart Shield brand, and the availability tables on the two sets of pages do not yet agree.

‍

Most audits get the order wrong here. Teams spend three weeks tuning headers and never turn on the upper tier, when tiering is a toggle with a larger effect than every header change combined. Check one thing first: whether your platform bills the shield layer as its own request tier. Offload that arrives as a new line item is still worth having, but it is not free, and it belongs in the [CDN cost comparison → /blog-posts/cdn-pricing-comparison] before you commit.

Purging is a hit-ratio decision in disguise

Purge-all at deploy time is a self-inflicted origin incident: every edge misses simultaneously on the next request for every object.

‍

Surrogate keys are the alternative — tag responses with keys and purge by tag. Individual keys are capped at 1,024 bytes and the total header at 16,384 bytes; beyond that "the key currently being parsed and all keys following it within the same header will be ignored" (Fastly docs, accessed 2026). Tag a category page with its product identifiers and a price change purges exactly the pages that display it.

‍

Soft purge is the second half. It marks content outdated while keeping it usable — "stale objects remain available to use in some circumstances while Fastly fetches a new version from origin" (Fastly docs, accessed 2026) — and requires either ETag/Last-Modified on origin responses or stale_while_revalidate configured together with stale_if_error. Without that groundwork it does close to nothing.

The optimization sequence, in the order that pays

1. Measure origin egress in bytes per hour, split by content type. Not hit ratio. If bytes are flat and requests are spiky, you have an expiry problem; if both are high, you have a key problem.
2. Dump the actual cache key your platform computes for your top 20 URLs by origin fetches. Most fragmentation is visible in one look.
3. Strip tracking parameters and normalise query string order and case before the key is computed.
4. Reduce Vary to the minimum set, remove Vary: Cookie from anything you intend to cache, and confirm whether your platform honours Vary at all — on Cloudflare it is off by default and must be enabled in Cache Rules. Never rely on Vary alone to keep per-user content out of a shared cache.
5. Split cache behaviours by path so static assets never carry cookies or session headers. This, not Vary, is what actually protects authenticated content.
6. Split edge lifetime from browser lifetime — Surrogate-Control: max-age where it is honoured, otherwise s-maxage long with max-age short — and add stale-while-revalidate. Add stale-if-error only after checking the platform: on Cloudflare an applicable s-maxage or must-revalidate, or Always Online being on, disables it (Cloudflare docs, accessed 2026).
7. Put ETag or Last-Modified on every cacheable response so stale objects revalidate into a 304 instead of a full refetch.
8. Enable tiered caching or origin shield, then re-measure origin bytes — this is the step with the largest single effect.
9. Replace purge-all with tag-based soft purge and wire it into the deploy pipeline.
10. Re-baseline after seven days. Cache fill has to complete across the footprint before any number means anything.

What breaks in production

Logged-in HTML cached at the edge. A minimum TTL above zero overriding no-cache, no-store and private (AWS docs, accessed 2026) is how one user's account page gets served to another. This is the failure that ends careers, and it is a two-field misconfiguration.

‍

Vary trusted as an access control. The same outcome by a different route. Cloudflare does not consider vary values by default (Cloudflare docs, accessed 2026), so a page shipping Vary: Cookie is stored as one object and served to every visitor. The dangerous part is that this looks better on your dashboard — hit ratio goes up — right up to the point someone sees another user's session. Path-based cache separation is the control; Vary is a hint your platform may ignore.

‍

"We raised the TTL and nothing happened." On Cloudflare, HTML and JSON are not cached by default (Cloudflare docs, accessed 2026). The TTL was raised on content the CDN was never storing.

‍

Compression variance removed instead of normalised. "Shrink the cache key" and "drop Accept-Encoding" read as the same advice and are not. Removing the variance without removing the variation ships a Brotli-encoded body to a client that asked for identity, or an uncompressed body to everyone. Normalise the header — CloudFront's cache policy compression settings collapse it to br,gzip (AWS docs, accessed 2026) — and never strip Vary: Accept-Encoding from a response whose body actually varies by encoding.

‍

Soft purge that does nothing. Without ETag/Last-Modified or stale_while_revalidate and stale_if_error configured together, soft purge has nothing to serve from (Fastly docs, accessed 2026).

‍

Header advice copied between platforms. The s-maxage plus stale-if-error pairing is the clearest case — correct on CloudFront, self-cancelling on Cloudflare (Cloudflare docs, accessed 2026). Caching headers are a specification; honouring them is a per-vendor decision. Test the response, do not trust the article, including this one.

‍

Hit ratio improves, bill does not. Almost always fragmentation on large objects: the small files got better and the heavy ones still miss. Check bytes, not requests.

‍

Cache fill measured too early. Any change to the cache key invalidates the entire stored set, so the first day after always looks worse. Judging it on day one is how good changes get reverted.

The ceiling no vendor will mention, and how to decide

Your hit ratio has a ceiling set by your catalogue, not your configuration.

‍

If most of your objects are requested once — a large media library, user-generated storage, a long-tail download archive — edge caching adds a hop and a fill cost and cannot reach a high hit ratio at any TTL. The honest fixes are a tiered topology that concentrates fills, a shorter path between origin and users, or a provider whose pricing model suits long-tail delivery rather than one that prices as if you were a news site.

‍

Every platform's optimization guide is written to make its own cache look effective. None will tell you that your content shape is the binding constraint, because the conclusion is sometimes "this is the wrong CDN for your workload" — see [how to switch CDN providers without downtime → /blog-posts/cdn-shutdown-migration-playbook] for what that migration costs. We say it because we sell across providers rather than one of them.

‍

So take the branch that matches your measurement:

‍

• Origin bytes high, hit ratio high. Fragmentation on large objects. Fix the cache key, starting with query strings and Vary.
• Origin bytes spiky on a fixed interval. Synchronised expiry. Add stale-while-revalidate and stagger TTLs across object classes.
• Origin requests high, bytes moderate. Every PoP fetching independently. Turn on tiering or shield before touching a single header.
• Hit ratio structurally low across everything. Catalogue shape, not configuration. Re-examine topology and provider fit, and read [where egress fees actually land → /blog-posts/cloud-egress-fees-comparison] before you renegotiate.
• Hit ratio fine, bill still wrong. The problem is the rate card, not the cache. Start from [optimizing CDN costs → /blog-posts/optimize-cdn-costs-strategies-and-best-practices].

‍

What is a good cache hit ratio? There is no universal target, because the ceiling depends on how often your objects are re-requested. A media catalogue with long-tail access cannot reach the same ratio as a news site serving the same assets to everyone. Judge a hit ratio against your own baseline and against origin bytes, not against a published benchmark.

‍

We run this sequence across whichever CDNs a client already uses, and the deliverable is the origin-bytes delta, not a hit-ratio chart. Having the cache key on your top-20 origin fetches dumped and read before you change anything is the place to start — and if the answer turns out to be topology rather than headers, a [multi-CDN routing setup → /blog-posts/multi-cdn-strategy] is the next conversation, not another round of TTL edits.

FAQ

Does raising TTL always improve cache hit ratio? No. TTL only matters for objects the CDN is already storing under a stable key. If tracking parameters or Vary headers are fragmenting the key, a longer TTL preserves more duplicate copies rather than fewer, and the first request for each still reaches origin. Fix key cardinality before touching freshness values.

‍

What is the difference between cache hit ratio and origin offload? Cache hit ratio measures the share of requests served from cache. Origin offload measures the share of bytes served to users that did not come from origin (Fastly blog, accessed 2026). Because object sizes vary, the two can move in opposite directions. Origin offload tracks your egress bill; hit ratio does not.

‍

Should I use max-age or s-maxage? Both. s-maxage applies to shared caches and takes precedence over max-age in them (RFC 9111 §4.2.1, 2022). Setting s-maxage long and max-age short holds objects at the edge while keeping browsers honest, so a purge on publish reaches every user without your origin absorbing the expiry.

‍

Is origin shield worth enabling on a small site? Usually yes on request volume, and it should be checked on cost. A shield collapses many independent PoP fetches into a single origin request per object (AWS docs, accessed 2026). The caveat is that some platforms bill the shield layer as its own request tier, so confirm the rate card before assuming the offload arrives free.

‍

Why did our cache hit ratio drop after a configuration change? Any change to the cache key invalidates every stored object, so the entire footprint refills from origin. That refill period looks identical to a regression. Hold the change for at least a full traffic cycle — seven days on most sites — before comparing, and compare origin bytes rather than hit ratio.

‍

Can a CDN cache a page my application marked no-cache? Yes. CloudFront documents that a minimum TTL above zero causes caching "even if the Cache-Control: no-cache, no-store, or private directives are present in the origin headers" (AWS docs, accessed 2026). Audit minimum TTL on every cache behaviour that can serve authenticated paths before you trust your origin headers to protect you.

‍

A single blocked Hetzner IP address took 325 unrelated domains offline in Italy. One of them belonged to a Portuguese hosting provider, which lost email connectivity with its Italian customers for 16 days. Neither had anything to do with the pirated football stream the block was aimed at (Sommese, Sperotto, van der Ham, Affinito and Prado, 90th Minute: A First Look to Collateral Damages and Efficacy of the Italian Piracy Shield, University of Twente, peer-reviewed, CNSM 2025). On average, domains caught in that collateral damage stayed unreachable for around 320 days. CDN IP blocking is not a censorship story — it is a reachability risk sitting inside every anycast CDN contract, and almost nobody prices it.

The mechanic: anycast means sharing reachability with strangers

A hyperscale CDN serves thousands of customers from the same anycast IP ranges. That is the design — it is what makes anycast fast and what makes DDoS absorption possible. It also means the routable address your customers resolve to is shared with tenants you did not choose and cannot audit.

‍

When a regulator blocks by IP rather than by domain, everything on that address goes with it. Your site does not need to be the target. It only needs to be a neighbour.

‍

The clearest public example of the mechanic is a Cloudflare Community thread from July 2026: a site owner found their domain unreachable from Russia because it resolved to a shared Cloudflare IP that had been added to the state blocklist over a completely unrelated site sharing the same address. The browser simply spun — no error, no notification, connection silently dropped.

‍

You cannot fix this by being compliant. Your legal standing is irrelevant to a /24 null route.

‍

The Twente study put names to who actually gets hit. Of 7,114 domains affected during the study window, researchers manually confirmed 510 as legitimate sites with no connection to streaming — hotels, restaurants, retail shops, an accountant, a car mechanic, a nunnery, and a telehealth missionary program among them. In three separate cases, blocking one IP address caused 60 collateral blocks each. Mail server IPs were blocked in 782 cases and nameserver disruption in 397 — meaning the damage extends past the website to email and DNS.

‍

And there is a second-order effect that should concern anyone leasing IPv4 space. Of the 10,918 blocked addresses, 24% were linked to leased address space, and 453 addresses were leased for the first time after they had already been blocked. The new tenant inherits an address that is silently unreachable from Italy, with no notification and no obvious cause. A further 250 addresses were re-leased to different companies while still under block. If you lease IPv4 space for a CDN origin or a mail server, check the block status of the range in your target markets before you announce it — the study's authors describe the polluted address space they leave behind as one of the system's lasting harms.

Four jurisdictions, one pattern

This is not a Russia story. It is a structural consequence of IP-level enforcement, and it is happening across regulatory contexts with very different intentions.

‍

Sources: TorrentFreak (2025); RIPE Labs and APNIC Blog (2025) on the Piracy Shield study; TechRadar (2025); The Record (2024, 2025); DNS at Risk.

‍

Note what Italy, Spain and Austria have in common: these are EU member states pursuing copyright enforcement, not censorship. The intent does not change the blast radius. Any business with customers in those markets carries the same exposure as one serving a heavily censored market — which is why this belongs in an infrastructure risk register rather than a politics conversation.

‍

The Austrian outcome is the most useful signal in the table: a regulator that tried IP-level blocking on shared infrastructure and then banned it, because the collateral damage was indefensible. That is the direction of travel, but it arrives jurisdiction by jurisdiction, years apart.

Blocking happens at four layers, and each has a different fix

Teams conflate these, then apply the wrong countermeasure and conclude nothing works.

The ECH case deserves its own note because it is the single most common misdiagnosis in this space. Cloudflare enables Encrypted Client Hello by default; Russian networks have blocked TLS connections using the ECH extension since 2024. The result is a site that becomes unreachable in waves, which owners routinely misread as "Cloudflare is fully banned." It usually isn't. With ECH turned off, connections fall back to plain SNI and typically stop being dropped — a zone-level configuration change, not a migration.

‍

Check ECH before you plan a CDN migration. It is free, reversible, and resolves a meaningful share of cases that look like IP blocking but aren't.

Why you find out last

There is no notification. No appeal path that operates on infrastructure timescales. In Italy, the blocklist behind Piracy Shield is not published — AGCOM has repeatedly refused freedom-of-information requests for it, leaving only single-IP lookup tools with no bulk export. Cloudflare told Human Rights Watch in May 2025 that it is generally unable to identify or confirm government-directed blocking and had received no notice from any Russian entity about the reported disruptions.

‍

Read that carefully: the regulator will not tell you, and your CDN cannot tell you. Your first signal is a traffic drop from one country, and if that country is not a top-three market you may not notice for weeks.

‍

Monitoring from inside the affected market is the only reliable detection. Synthetic checks from your own CI or from a US/EU monitoring region will pass while real users in the blocked market see nothing. If you have meaningful revenue from a market with an active blocking regime, you need a probe that actually resolves and connects from inside it.

What no CDN vendor will tell you

A large CDN cannot publish this article. Cloudflare cannot write "our IP ranges are subject to state-level blocking in several markets, so consider a provider with a smaller footprint." Akamai cannot either. The structural incentive runs the other way: their answer to concentration risk will always be more of their own product. That is not dishonesty, it is positioning — but it means the SERP for this problem is written entirely by parties who cannot recommend the fix.

‍

The fixes that exist are gated behind Enterprise. Cloudflare's BYOIP, where Cloudflare announces IP space you lease or own across its locations, is Enterprise-only. The traditional onboarding path ran up to four to six weeks, involving addressing teams, network engineering, legal, and a Letter of Agency — Cloudflare has since launched a self-serve BYOIP API that removes much of that manual process. Either way, BYOIP is a posture you adopt in advance, not a lever you pull during an outage.

‍

Not every "dedicated IP" product solves this problem, and the distinction matters. Cloudflare's Dedicated CDN Egress IPs sound like the answer and are not: they govern traffic from Cloudflare to your origin, for origin allowlisting and firewall lockdown, not the address your users resolve to. Buying them changes nothing about whether a regulator can reach you. The controls that affect the user-facing address are BYOIP, leased static IPs with address maps, and the certificate option below.

‍

And leased static IPs solve only half the problem. They are still Cloudflare addresses. If a neighbour on your shared IP gets you blocked, a static address fixes it. If a regulator blocks Cloudflare's ranges wholesale — as happened across eastern Russia in March 2025 — a static Cloudflare IP goes down with everything else. Only address space that is yours, or a provider whose ranges are not listed, survives range-level blocking. Match the control to which of the two failure modes you actually face.

‍

There is one cheap partial mitigation almost nobody uses. Business and Enterprise customers can reduce the number of Cloudflare IPs their domain shares with other customer domains by uploading a Custom SSL certificate. That does not give you a dedicated address, but it shrinks the neighbourhood — fewer strangers on your IP means lower probability of inheriting someone else's block. For a Business-plan site with exposure to an active blocking regime, it is the highest ratio of risk reduction to effort available.

‍

And the honest limit on all of this: if a block is a lawful order directed at your own content in a market where you operate, the answer is legal and compliance work, not a different IP range. Infrastructure diversity solves collateral damage — being caught by someone else's enforcement. It does not solve being the target, and any provider who pitches it that way is selling you a problem rather than a solution.

What breaks in production

You migrate CDN and inherit a new set of neighbours. Moving from one hyperscale anycast provider to another swaps one shared-IP exposure for a different one. If the new provider's ranges are already listed in your target market, you have executed a migration for nothing. Check the destination's IP ranges against the market's blocklist status before cutover, not after.

‍

Your monitoring says everything is fine. Covered above, and it is the most common failure. Region-blind synthetic monitoring is how a two-week outage in a secondary market becomes a quarterly revenue surprise.

‍

Lowering TTLs after you need them is too late. If your records sit at 86,400 and a market goes dark, your fastest possible failover is a day away. Pre-lowered TTLs on anything exposed to a blocking regime are cheap insurance — the same discipline covered in our [CDN migration playbook → /blog/cdn-shutdown-migration-playbook].

‍

Regional CDNs solve reachability and introduce other constraints. A provider with local presence in a market is far less likely to be blocked there, and often has better last-mile performance. It will also usually have a smaller global footprint, different feature coverage, and its own compliance obligations in that jurisdiction. That is a real trade, not a free win.

‍

"Not blocked yet" is a depreciating asset. Selecting a provider purely because regulators have not reached it is a position with a shelf life. The durable property is not obscurity — it is how fast you can move when it changes, which is a procurement and architecture question rather than a provider-selection one.

The mitigation ladder

Work down this list; each step costs more than the one above it.

‍

1. Check ECH first. If the symptom is intermittent unreachability in a specific market, disable ECH on the zone and re-test before doing anything else. Free, reversible, resolves a large share of misdiagnosed cases.
2. Deploy in-market monitoring. You cannot manage exposure you cannot see. One probe resolving and connecting from inside each market that matters.
3. Upload a Custom SSL certificate if you are on a plan that supports it, to reduce the number of domains sharing your IPs.
4. Pre-lower TTLs on any hostname serving a market with an active blocking regime.
5. Keep a second CDN configured and warm, carrying real traffic at a small percentage rather than sitting idle with stale config and expired certificates.
6. Evaluate a regional provider for markets where reachability is a revenue-critical requirement, accepting the feature and footprint trade honestly.
7. Consider BYOIP or leased static IPs if you have Enterprise scale and the market exposure justifies it — static IPs for neighbour risk, BYOIP for range-level risk. Start the process before you need it.

The decision framework

Three questions decide how much of this ladder applies to you.

‍

• Do you have revenue from a market with an active IP-blocking regime? If no, steps 1 and 2 are still worth doing and the rest is over-engineering. If yes, you need at least through step 5.
• Is the exposure collateral or direct? Collateral — someone else's content on your shared IP — is an infrastructure problem with infrastructure fixes. Direct — a lawful order about your content — is a legal problem, and no CDN change resolves it.
• How fast can you currently switch providers? Not "do you have a second CDN," but: certificates provisioned, config parity verified, TTLs low, contract already in place. If the honest answer is measured in weeks, that is the gap to close, regardless of which provider you use today.

‍

INXY brokers CDN capacity across multiple providers — including regional and specialist networks that do not appear on hyperscaler comparison pages — on a single contract and a single invoice. The practical consequence is that adding or switching a provider is a configuration decision rather than a procurement cycle, which is precisely the capability this risk requires. We will also tell you when your problem is ECH rather than IP blocking and costs nothing to fix, because a migration you did not need is not a sale worth making.

‍

If you have a market where traffic dropped and you are not sure why, send us the affected hostnames and the market. [Request an infrastructure audit → /book-a-demo]. To review delivery options: [CDN, streaming and data delivery → /data-delivery].

‍

This article describes publicly reported regulatory and network conditions for general information. It is not legal advice — obligations differ by jurisdiction and by the nature of the content being served, and decisions with regulatory consequence should be reviewed by qualified counsel in the relevant market.

FAQ

Why is my site blocked in a country when I have done nothing wrong? Hyperscale CDNs serve many customers from shared anycast IP ranges. When a regulator blocks by IP address rather than by domain, every site on that address becomes unreachable regardless of its content. Documented cases include a single blocked IP disrupting 325 unrelated domains in Italy.

‍

Is Cloudflare blocked in Russia? Not fully. Sites behind Cloudflare load from Russia but unreliably, due to ECH connection blocking, shared-IP collateral damage, and targeted blocks of individual resources. Roskomnadzor has officially recommended against foreign CDNs, which is a recommendation rather than a prohibition, but a clear regulatory signal.

‍

What is ECH and why does it break my site? Encrypted Client Hello is a TLS extension that encrypts the server name during the handshake. Cloudflare enables it by default, and some national networks block TLS connections using it. This produces intermittent unreachability that looks like IP blocking. Disabling ECH on the zone usually restores connections.

‍

How do I know if my CDN's IP ranges are blocked somewhere? Monitor from inside the affected market. Synthetic checks running from US or EU regions will pass while real users in the blocked market see nothing. Neither the regulator nor your CDN will notify you — in Italy the blocklist itself is not published, and Cloudflare has stated it generally cannot confirm government-directed blocking.

‍

Does switching CDN providers fix IP blocking? Only if the destination's IP ranges are not already listed in that market. Moving between two hyperscale anycast providers swaps one shared-IP exposure for another. Regional providers with local presence are less likely to be blocked in their own market, at the cost of smaller global footprint and different feature coverage.

‍

Can I get dedicated IP addresses from a CDN? Some providers offer it at Enterprise tier. Cloudflare's BYOIP announces IP space you lease or own across its network, and leased static IPs with address maps fix which addresses your domain resolves to. Note that Dedicated CDN Egress IPs are a different product governing Cloudflare-to-origin traffic, not the user-facing address.

‍