What's the best CDN to secure and speed up an online store?
It depends on your platform first. On Shopify, you already have one. On WooCommerce or PrestaShop, adding it is your job, and so is making sure it never caches a cart.
A CDN (content delivery network) keeps copies of your pages and images on servers close to your shoppers, so product pages load faster and your origin server gets a break. For a store, it's also the front door: it absorbs DDoS floods, filters intrusion attempts with a web application firewall (WAF), and sorts out the bots that stuff carts or test stolen cards at checkout.
The short answer. On WooCommerce or PrestaShop, start with Cloudflare on the free plan, move to Pro at $20 a month once bots become a problem, and to Business at $200 if you need Cloudflare's PCI DSS checkbox. Bunny.net is the cheapest serious alternative if images and video make up most of your traffic. On Shopify, don't put a CDN in front of your store: Shopify's own network already does the job, and a proxy in front of the storefront isn't supported. Your real problem there is bots.
If you only want the cheapest CDN per terabyte, our best CDN comparison works out the bill at 1 and 10 TB a month. This page is about your store: what happens at the cart, the checkout and the payment.
The ranking is editorial: a sponsored placement is always labeled on its card, and no affiliate link ever changes a score.
The best protection for your situation
Free to start, Pro at $20 a month for bot rules
Image- and video-heavy catalog$0.01 per GB in North America and Europe, free basic WAF
EU vendor, euro billing1 TB free each month, then €0.01 per GB
Store running on AWS$15 Pro flat-rate plan with 25 WAF rules
Store that's been hacked beforeFirewall and malware cleanup in one plan
Headless store with developersFully programmable cache, 100 GB free a month
6 CDNs and firewalls for online stores
The full ranking. The "store protection" column sums up what matters for a merchant: bots, firewall and compliance. Prices are the ones each vendor publishes, in dollars, except Gcore, which bills in euros.
| Best for | Store protection | Free plan | Team size | Visit | ||||
|---|---|---|---|---|---|---|---|---|
| 1 | Cloudflare | Best for WooCommerce and PrestaShop | Simple bots filtered for free, PCI DSS checked from Business | 4.6/5 | Free, Pro $20/mo billed yearly | ✓ | Self-hosted stores of any size | Visit → |
| 2 | Bunny.net | Best protection for the price | Free WAF (71 rules), bot filtering from $9.50/mo | 4.4/5 | $0.01/GB in NA and EU, $1/mo minimum | — | Stores with lots of images and video | Visit → |
| 3 | Gcore | Best EU option billed in euros | Bot management as an add-on on Pro and Enterprise | 4.1/5 | 1 TB free/mo, then €0.01/GB | ✓ | Stores that want an EU vendor | Visit → |
| 4 | Amazon CloudFront | Best for stores on AWS | 5 WAF rules free, 25 on Pro, bot control from Business | 3.9/5 | Free, Pro flat rate $15/mo | ✓ | Headless or custom stores hosted on AWS | Visit → |
| 5 | Sucuri | Best after a hack | Firewall, DDoS and malware cleanup together | 3.6/5 | Basic $9.99/mo, Pro $19.98/mo | — | WordPress or Magento stores recovering from a hack | Visit → |
| 6 | Fastly | Best for engineering teams | Next-Gen WAF and bot management quoted by Fastly on request | 3.4/5 | 100 GB free/mo, then $0.12/GB | ✓ | Large or headless stores with developers | Visit → |
Prices read on each vendor's official pricing page in 2026. Scores for Cloudflare, Bunny.net, Gcore, CloudFront and Fastly match our best CDN comparison; Sucuri is rated on the same scale. Rank follows how well each fits a store, not price alone.
Is your tool missing from this page? Email us: hello@hackceleration.com
How we compared and scored
The pages ranking for this search are mostly vendor-written lists that put the vendor first. None of them covers what happens at the cart, the checkout or the payment webhook. Shopify barely gets a mention, even though it's the one platform where adding a CDN is a mistake. And PCI DSS, the card security standard every merchant hears about, doesn't come up at all.
We read every vendor's official pricing page, tier by tier, to see what's actually included: WAF, bot management, DDoS protection, compliance, support. Then we went through the Shopify Community, WordPress.org and hosting forums, where merchants describe what really breaks: empty carts, stuck payments, bots adding products by the thousand. Every tip on this page comes from those threads.
Scores for Cloudflare, Bunny.net, Gcore, CloudFront and Fastly are the ones from our general CDN comparison: a tool gets one score across the site. Sucuri isn't in that comparison, so we rated it on the same scale. KeyCDN isn't ranked here because it lists no WAF at all. Akamai, Imperva and DataDome sell to large retailers on negotiated contracts: we cover them below without a score.
- Network and speedCoverage where your shoppers are, caching for product images and pages.20%
- Included securityWAF, bot management, DDoS and compliance, tier by tier.25%
- Value for moneyWhat a store pays per month for real protection.30%
- Ease of setupHooking it up to WooCommerce or PrestaShop, cart and checkout rules.15%
- SupportSupport channel on the tier a store actually buys.10%
No affiliate link changes a score or a rank.
Cloudflare
Cloudflare sits in front of your whole site: every visit goes through its network before it reaches your server. On the free plan you already get unmetered DDoS protection, a managed WAF ruleset and filtering for simple bots. For a new store, that's more than most hosts include.
The tiers are easiest to read through bot protection. Free catches simple bots. Pro, at $20 a month billed yearly, catches easy-to-detect bots and adds lossless image optimization and APO for WordPress (a $5-a-month add-on on Free). Business, at $200 a month, detects sophisticated bots and adds basic analytics. And only from Business up does the plan table check PCI DSS 4.0, along with a 100% uptime SLA and chat support.
What merchants report: Free is enough for plenty of stores, but its Bot Fight Mode is all-or-nothing. A WAF skip rule doesn't exempt traffic from it, so it can block your payment gateway's webhooks. People who pay for Pro say it's worth it for the tunable WAF and image handling, not for caching. And the global outage in late 2025, caused by an internal bot-management file that doubled in size, took product pages down with it.
Tip: Free gives you 70 rules. Set three aside for your store on day one: bypass cache on cart, checkout and account; let your payment webhook through; harden the checkout. Details are in the settings section below.
- Unmetered DDoS protection, even on Free
- PCI DSS 4.0 checked from Business
- Most rules per tier: 70, 225, 450
- ✓The most complete free plan here
- ✓Pro at $20 adds image optimization and APO
- ✓Works the same on WooCommerce and PrestaShop
- ✗Free plan bot mode is all-or-nothing
- ✗Forum-only support on Free
- ✗When it goes down, so does your store
The best starting point for a self-hosted store. Start on Free, set up cart caching rules on day one, and keep Business for the day your acquirer asks about PCI on the network side.
Bunny.net
Bunny.net is a European CDN billed by usage: $0.01 per GB delivered in North America and Europe, with a $1 monthly minimum. A store pushing 500 GB of images a month to US and EU shoppers pays $5. The 14-day trial doesn't ask for a card.
Protection comes from Bunny Shield. The free Basic tier runs 71 WAF rules, covers the OWASP Top 10 at a basic level but doesn't filter bots, and its block page carries bunny.net branding. Advanced, at $9.50 a month, steps up to 255 rules, filters simple bots and lets you use your own block page. Business, at $99 a month, also catches complex bots.
Customers mostly talk about support, which answers in minutes, rare at this price. Complaints are about deleting an account and a price that's a bit higher than some rivals at volume. One useful detail for stores: Shield inspects request bodies up to 256 KB on Basic, 512 KB on Advanced and 1 MB on Business, which is what lets it read a checkout form submission.
Tip: if you only want faster WooCommerce images without touching the rest of the site, point Bunny at a subdomain from your caching plugin. Your cart never goes through the CDN, so it can't get cached by mistake.
- Free basic WAF with 71 rules
- Bot filtering from $9.50 a month
- Support known for fast replies
- ✓Lowest per-GB price here in NA and EU
- ✓14-day trial, no card
- ✓Can serve images only
- ✗Branded block page on Free
- ✗Usage billing is less predictable
- ✗No PCI line on the pricing page
The best value for a media-heavy store. Go to Advanced at $9.50 as soon as bots start filling your carts.
Gcore
Gcore is headquartered in Luxembourg. Its CDN includes 1 TB a month free, then charges €0.01 per GB, with no subscription or card needed to start. For a mid-size store, the CDN alone often costs nothing.
Protection is a separate product called WAAP: web application firewall plus API protection. Bot management isn't available on its Free and Start tiers; it's an add-on on Pro and Enterprise. Paid tiers come with a 30-day trial, no card. That's the catch for merchants: delivery is cheap, but bot protection means moving up a tier.
Our take: Gcore suits stores that want an EU vendor and euro billing. Its support has a weaker reputation than Bunny.net's, and its WAAP documentation doesn't list amounts, so ask for the bot add-on price before you commit.
Tip: start with the free CDN for images and static files, watch a month of traffic, then decide whether paid protection is worth it or whether free Cloudflare in front of the site does the job.
- 1 TB free every month
- Euro billing from an EU vendor
- 30-day trial on protection tiers
- ✓Free CDN for most stores
- ✓Clear, tiered per-GB pricing
- ✓No subscription to start
- ✗No bot management on Free and Start
- ✗Protection pricing not published
- ✗Weaker support reputation
A good pick if you want to stay with an EU provider. Budget for the bot add-on: without it, your checkout isn't better protected than with free Cloudflare.
Amazon CloudFront
CloudFront is Amazon's CDN. With its flat-rate plans you pay a fixed price per distribution, with no overage surprise. Free covers 1 million requests and 100 GB a month, with 5 WAF rules. Pro, at $15 a month, goes to 10 million requests and 50 TB, with 25 rules and ready-made protections for PHP, WordPress and SQL injection.
The catch for stores: neither Free nor Pro includes bot management. You need Business, at $200 a month, to handle self-identifying bots, with advanced DDoS protection and an SLA. Premium, at $1,000, goes to 500 million requests. Baseline DDoS protection is always on across all plans.
Our take: CloudFront shines when your store already lives on AWS (a headless storefront, a Next.js front end, images in S3). For WooCommerce on regular hosting, its console is more technical than Cloudflare's and every rule is built by hand.
Tip: the $15 Pro plan is the best deal here for a store on AWS without a bot problem. When fake carts show up, compare the cost of Business with Cloudflare Pro in front.
- Fixed price with no overage
- 25 WAF rules from $15
- Always-on DDoS on every plan
- ✓Predictable flat pricing
- ✓Ready-made WordPress and SQL rules
- ✓Great for headless stores on AWS
- ✗No bot management under $200
- ✗Technical console
- ✗Slower to set up than others
The right pick if your stack is already on Amazon. For a store under bot pressure, the jump from $15 to $200 a month hurts.
Sucuri
Sucuri is a website security company first and a CDN second. Its cloud WAF sits in front of your store, blocks DDoS attacks at layers 3, 4 and 7, and applies virtual patches: it blocks a known plugin exploit before you've even updated the plugin. The CDN comes on top.
The firewall alone costs $9.99 a month on Basic and $19.98 on Pro, per site. The yearly platform adds malware cleanup: $229, $339 or $549 a year. Sucuri's SSL is marketed as "PCI compliant". That's vendor wording, not a compliance attestation for your store.
The weak spot is support. Public reviews are harsh: unanswered tickets, slow replies, refunds that are hard to get. Other customers praise effective cleanup after a hack. Support runs by ticket, 24/7.
Tip: Sucuri makes sense if your store has already been infected, since cleanup is part of the yearly platform. For a clean store, Cloudflare Pro protects as well for less.
- Virtual patching for known exploits
- Malware cleanup in the yearly plan
- Works with WordPress, Magento and other CMSs
- ✓Firewall and cleanup from one vendor
- ✓Simple public pricing
- ✓A sound move after a hack
- ✗Heavily criticized support
- ✗Mixed customer reviews
- ✗Priced per site, adds up with several stores
Useful for getting out of a hack and staying out. For a store that's never been hit, others protect better for less.
Fastly
Fastly is the CDN engineering teams pick. Its cache is programmable rule by rule, so you decide exactly which product page is kept and for how long. That matters for a store that changes prices and stock levels during a sale.
Pricing targets volume: 100 GB and 1 million requests free a month, then $0.12 per GB up to 10 TB and $0.08 after that. Its Next-Gen WAF and Bot Management aren't on the price list: Fastly quotes them based on your traffic.
Our take: Fastly isn't built for a WooCommerce store run by one person. Setup needs a developer, and its per-GB price is twelve times Bunny.net's in North America and Europe. For an ecommerce team running headless that wants control over every rule, it's a very solid tool.
Tip: ask for the WAF and bot pricing at the same time as the CDN quote. The security line is often bigger than the delivery line on the final bill.
- Fully programmable cache
- 100 GB free a month
- Next-Gen WAF available
- ✓Fine control over cached prices and stock
- ✓Built for headless
- ✓Fast network, rated 4.5 out of 5
- ✗High per-GB price
- ✗WAF and bots off the public price list
- ✗Needs a developer
For an engineering team running headless. For a store run solo, it's too expensive and too complex.
Shopify, WooCommerce, PrestaShop: three different answers
The right protection depends less on your revenue than on the platform your store runs on. Here's the answer for each, with a typical monthly budget.
Shopify: you already have a CDN
WooCommerce: adding a CDN is on you
PrestaShop: same logic, more traps
Large retailers: Akamai, Imperva, DataDome
- Check your platform first: on Shopify, don't proxy the storefront.
- List your real cart, checkout and account URLs.
- Find the URL where your payment gateway sends its webhooks.
- Decide who gets paged if your CDN goes down, and how to turn the proxy off.
- Ask your acquirer whether they expect PCI DSS beyond what your payment provider covers.
- Measure product page speed before and after.
Six settings for a CDN that won't break your store
A badly configured CDN does more damage than no CDN. These six settings come from the problems merchants raise most often on forums.
Never cache the cart
Must doIf your CDN keeps a copy of the cart page, the next shopper sees the previous one's cart, or an empty one. Add a cache bypass rule on WooCommerce cookies (woocommerce_items_in_cart, woocommerce_cart_hash and wp_woocommerce_session_) and on your actual cart, checkout and account URLs. Then check the cf-cache-status header: it should read BYPASS or DYNAMIC on those pages.
- Check
- cf-cache-status = BYPASS or DYNAMIC
Let payment webhooks through
TrapYour payment gateway tells your store an order is paid through an automated request. An overeager bot mode blocks it, and the order sits on "pending" even though the customer paid. On Cloudflare's free plan, Bot Fight Mode is all-or-nothing: a WAF skip rule doesn't exempt traffic from it. Turn it off if payments stop arriving, or move to Pro so you can exclude /wc-api/ precisely. Our payment gateway comparison goes deeper on webhooks.
- Path to exclude
- /wc-api/ on WooCommerce
Check the mini-cart after every new feature
WooCommerceTwo Cloudflare features can freeze the cart counter. Rocket Loader, which defers scripts, breaks the WooCommerce mini-cart: exclude cart-fragments.js or turn it off. APO stacked with a "cache everything" rule freezes the item count. After enabling anything new, add a product to the cart in a private window and check the counter.
- Script to exclude
- cart-fragments.js
Harden the checkout against fake orders
BotsCard-testing bots place orders in bulk to check stolen cards. Turn on bot protection, then add a WAF rule on /checkout/ and on the wc-ajax=checkout request: a challenge for suspicious visitors, not a block. Run through checkout yourself before the weekend, because a rule that's too strict blocks real customers too.
- Request to target
- wc-ajax=checkout
PrestaShop: strict SSL and real IP
SetupWith Cloudflare in front of PrestaShop, pick "Full (Strict)" SSL mode: "Flexible" causes endless redirect loops. Then set up real IP restoration on your server so your logs and anti-fraud modules see the shopper's address. Keep customer-specific pages out of the cache.
- SSL mode
- Full (Strict)
Plan for the day your CDN goes down
Plan BCloudflare's global outage in late 2025 wasn't an attack: an internal file doubled in size and the proxy started returning errors. Stores that knew how to switch the proxy off got back online on their own. Write down where that setting lives, keep access to your DNS zone, and make sure your host can take the traffic alone. If you're thinking of leaving, our page on switching from Cloudflare compares the options.
- Write down
- Where to turn the proxy off, and who does it
Your store is protected, now what
A CDN is one layer. These pages cover what sits around it.
The bill at 1 and 10 TB a month.
You're looking for a Cloudflare alternativeSwitch from CloudflareOptions and migration.
Attacks hit your server directlyDDoS-protected dedicated serversProtection at the hosting level.
You haven't picked a platform yetThe best ecommerce platformShopify, WooCommerce, PrestaShop and more.
Your payment provider is dropping ordersThe best payment gatewayFees, fraud and webhooks.
You also need to protect your team's laptopsThe best antivirus and EDRSecurity for company computers.
Frequently asked questions
Do I need a CDN for a small online store?
Yes, mainly for security. A small store rarely has a speed problem its host can't handle, but it gets the same bots and attacks as a big one. Free Cloudflare in front of a WooCommerce store costs $0 and adds a WAF, DDoS protection and simple bot filtering.
Does Shopify need a CDN?
No. Shopify already runs a global CDN backed by Cloudflare. A proxy in front of the storefront slows pages down and isn't supported. If Shopify shows a proxy error, switch the DNS record to "DNS only".
Is Cloudflare's free plan enough for WooCommerce?
For most stores, yes. What it lacks is precision: its bot mode is all-or-nothing and can block payment webhooks. Move to Pro, at $20 a month billed yearly, when you need targeted rules on checkout.
Does a CDN make my store PCI compliant?
No, not on its own. PCI DSS covers the whole card flow. If payment happens on your provider's page (Stripe, PayPal, your acquirer), they carry most of it. On Cloudflare, the PCI DSS 4.0 box is only checked from Business, at $200 a month.
How do I stop add-to-cart bots?
On WooCommerce and PrestaShop, with your CDN's bot filtering plus a challenge rule on add-to-cart. On Shopify, Cloudflare can't see that traffic: turn on checkout bot protection and watch for carts created through your myshopify.com address. Forced login works but costs sales.
How much does it cost to protect an online store each month?
Three typical budgets. $0 with free Cloudflare, enough for most small stores. Around $20 with Cloudflare Pro, or $9.50 for Bunny Shield Advanced plus traffic. Around $200 when you need advanced bot management and PCI on the network side.
Can a CDN slow my store down?
Yes, in two cases. On Shopify, a proxy adds a pointless hop. And if all your shoppers are close to an already fast server, going through a filtering layer can add a few milliseconds. Measure product pages before and after, from a phone on mobile data.
Will my prices and stock stay up to date behind a CDN?
Yes, if product pages refresh on their own or your plugin purges the cache on every change. The risk comes from a long "cache everything" rule. During a sale, shorten product page cache time or purge right after changing prices.