Migrating media delivery from Akamai to Cloudflare requires a route-by-route cache design. It is not just a DNS change. Record cache keys, origin headers, TTLs, query policy, purge scope, and range behavior. Cover image, VOD, HLS, and DASH paths.
Map the move before changing traffic
Build a route-level inventory from 7 to 14 normal traffic days. Include Akamai rules, CP Code reports, origin settings, cache keys, purges, and security controls.
Start with the routes that drive the most origin traffic. This makes the first test safer.
Set pass and rollback thresholds
Record Akamai baselines by route, region, and status code. Use real-user playback data and synthetic checks. Test headers, TLS, CORS, Range, and 206 Partial Content.
| Measurement | Canary passes when | Rollback when |
|---|
| Cache hit ratio | Within 2 percentage points of Akamai | Falls more than 5 points for 15 minutes |
| Origin egress | No more than 10% above baseline | More than 20% above baseline for 15 minutes |
| TTFB p95 | Within 50 ms of baseline | More than 100 ms slower for 15 minutes |
| Video startup and rebuffering | No material increase from baseline | Startup rises 10% or rebuffering rises 0.5 points |
Choose the smallest safe canary
Create media-canary.example.com pointing to the production origin. Route 1% to 5% of eligible traffic after all checks pass. Check DNS, TLS, CORS, WAF, and cache behavior for 30 minutes.
Use a temporary dual-CDN setup. Akamai remains the known-good path while Cloudflare gets a controlled share. Test rollback before the canary, not during an outage.
A dual-CDN canary shows cache mistakes before they affect all viewers.
Inventory rules
Build Cloudflare rules
Warm and test
Canary traffic
Cut over or roll back
⚠️ Do not start with all traffic. A cache-key error can raise origin egress within minutes.
Translate Akamai rules into Cloudflare behavior
Translate intended outcomes instead of copying Property Manager rules. The providers can form different cache objects from the same request.
Write down each rule's purpose before choosing its replacement. A copied setting may not produce the same cache result.
Build the control equivalence table
Keep each Akamai rule ID beside its Cloudflare replacement. On-call engineers can then trace wrong responses quickly.
| Akamai control | Cloudflare equivalent | Migration check |
|---|
| Property Manager cache behavior | Cache Rules | Confirm rule order and bypass cases |
| Cache Key behavior | Custom Cache Key or Worker | Test query, cookie, and header variance |
| CP Code reporting | Analytics and Logpush fields | Keep route and asset-type dimensions |
| SureRoute or origin shielding pattern | Tiered Cache or Worker origin routing | Measure origin request reduction |
| URL or CP Code purge | URL, prefix, hostname, or cache-tag purge | Rehearse release invalidation |
Classify every request variable
For each query parameter, cookie, and header, assign one action: keep it in the key, ignore it, validate then remove it, or bypass cache.
Keep image-transform variables in the cache key. Ignore tracking parameters that do not change output. Validate signed tokens before removing them.
The most common error here is ignoring a parameter that changes media output.
Do not treat Tiered Cache, Cache Reserve, and origin routing as the same control. Each one solves a different problem.
Tiered Cache reduces duplicate origin fetches through upper cache tiers. A Worker can select or fail over between origins. Use a Worker when routing logic is needed.
Cloudflare Cache Reserve can act as a persistent cache layer. Its use depends on your plan and needs. It can cut origin egress for long-lived cacheable media.
Versioned images, VOD segments, thumbnails, and captions are common candidates. Record the allowed asset classes before enabling it.
Cache Reserve does not replace Akamai SureRoute. It also does not replace token checks or origin shield design. Record retention needs, purge needs, and acceptable origin-request cost.
⚠️ Do not remove signed-token values from a cache key before a Worker or origin validates them.
Create separate TTL policies for each media type. Immutable VOD segments and live playlists need very different freshness rules.
A TTL is the time an object stays cached. Think of it like a store shelf label. It tells the CDN when to ask the origin again.
Apply these deployable cache rules
Use narrow Cloudflare rules before broad rules. Pair them with matching origin Cache-Control headers. You can also set clear edge TTL overrides.
- Versioned images: Match `/images/` with `v=` or fingerprinted filenames. Keep `width`, `height`, `format`, `quality`, and `dpr` in the key. Ignore marketing parameters. Set edge TTL between 30 and 90 days. Set browser TTL between 7 and 30 days.
- Dynamic image transforms: Match `/image/resize/`. Bypass cache when a session cookie changes output. Otherwise, key on transform parameters. Set edge TTL between 1 and 7 days.
- VOD segments: Match `.ts`, `.m4s`, `.cmfv`, or `.mp4` under `/vod/`. Cache versioned segments for 30 to 90 days. Allow `stale-if-error` for 1 to 24 hours.
- HLS and DASH manifests: Match `.m3u8` and `.mpd`. Set VOD manifest TTL between 5 and 30 minutes. Set live playlists between 2 and 10 seconds. Base this on segment cadence.
- Captions and thumbnails: Match `.vtt`, `.jpg`, and `.webp` under media paths. Cache versioned files for 7 to 30 days.
Test ranges, purges, and cache warming
Test full GET and HEAD requests against both CDNs. Test initial and mid-file ranges. Test valid and expired signed URLs. Test CORS OPTIONS requests too.
Confirm status codes, Content-Range, CORS, cache status, and object length. Warm only top assets by region and type.
A 206 Partial Content response must match the requested byte range.
Turn cache policy into clear match conditions. This keeps image and video caching predictable after cutover.
For /images/, cache only jpg, jpeg, png, webp, and avif responses. Include width, height, format, quality, and dpr in the cache key. Exclude utm_*, gclid, and other tracking parameters.
Create a separate /vod/ rule for .ts, .m4s, .cmfv, and .mp4 files. Do not ignore authorization values unless a Worker or origin has checked them.
For HLS and DASH, match .m3u8 and .mpd separately. Bypass requests with personalization cookies. Vary only on headers that change the response.
Origin may change the response when CORS is origin-specific. Include it only in that case.
Use a release-specific purge scope and sequence. Do not purge every media URL after a release.
Publish new versioned images, transformed outputs, VOD segments, and captions first. Check content type, length, and Range behavior for every object. Include 206 Partial Content checks.
Update or purge the HLS or DASH manifest only after that. A manifest purge before segments exist can cause player 404 errors.
Purge transformed images by exact URL when query parameters define the rendition. Use a cache tag when all renditions of one source asset must disappear together.
Use prefix or hostname purges only for incident recovery. Their wide scope can collapse cache hit ratio. They can also sharply increase origin egress.
⚠️ Do not purge a live manifest before its referenced segments are available at the origin.
Run the canary and prove the cutover
Increase traffic from 1% to 5%, then 10%, 25%, 50%, and 100%. Move forward only after each review window passes. Compare matching routes, regions, and device classes.
Do not compare a weekday evening canary with a quiet weekend baseline. Traffic mix changes playback and cache results.
Inspect live requests and player data
Check cache status, Age, ETag, Cache-Control, and Content-Type. Check CORS and Accept-Ranges too.
Review 4xx and 5xx errors separately. A 403 often means token or WAF trouble. An HLS 404 can mean a stale playlist.
Handle failures without guessing
Use the tested steering, weighted DNS, or CNAME rollback when a threshold fails. Keep Cloudflare settings for analysis, but stop new traffic.
Observe VOD for 24 hours. Observe live streaming through a full event cycle.
A rollback is successful only when viewers return to the known-good CDN path.
Cut over only when cache-hit ratio, origin egress, TTFB p95, error rates, startup time, and rebuffering meet agreed limits. Lower latency alone is not a pass condition.
⚠️ Do not wait for a full outage before rolling back. A failed threshold for 15 minutes is enough.
Questions & answers
How do I move from Akamai to Cloudflare safely?
Start with a 1% to 5% hostname or path canary. Keep Akamai available. Expand only when performance, errors, playback, and origin cost meet written limits.
Does Cloudflare cache images and video files?
Cloudflare can cache images, VOD assets, HLS segments, and DASH segments. Rules and headers must permit caching. Playlists, signed requests, and personalized responses need separate policies.
What TTL should I use for HLS playlists?
Use 2 to 10 seconds for live HLS media playlists. Base the value on segment duration and latency targets. Use 5 to 30 minutes for stable VOD manifests.
Check the path, origin mapping, cache status, and playlist references before purging. HLS 404 errors often mean a stale playlist points to an expired or moved segment.
Finish with a reversible DNS cutover
Change the production CNAME after the canary passes its observation window. Rehearse rollback first. Retain Akamai for 24 to 72 hours for VOD. Keep it through a full live event.
Document the final cache key, TTL, purge scope, and origin-egress baseline. Name an owner for every media hostname.
A reversible cutover protects viewers when an edge rule behaves differently.
⚠️ Do not delete Akamai properties, certificates, or purge access right after cutover. Keep them until rollback ends. Confirm stable origin traffic in billing reports.
