Delivery from operator nodes

Evolving Edge delivers your site from two tiers: Regional Gateways, which Evolving Edge runs in data centers, and operator nodes, devices that independent operators run in homes and offices near your visitors. This page explains when a visitor’s browser fetches your files from an operator node, which sites and files qualify, and what keeps that safe.

It isn’t peer-to-peer. Visitors never share your content with each other. Operator nodes hold copies of your site’s files, and a visitor’s browser fetches files from them, checking every piece before it’s used.

How it works

The page comes from a Regional Gateway. Every HTML page is delivered by a gateway, with your _redirects and _headers rules applied.
The gateway adds a small script to the page when operator nodes near the visitor hold your site. The script lets the browser connect to those nodes.
The browser fetches the page’s files from nearby operator nodes: its stylesheets, scripts, images and fonts. Each file arrives in pieces, and the browser checks every piece against your site’s fingerprint, which it gets from the gateway. A piece that doesn’t match is thrown away.
The gateway is always the fallback. If no node answers in time, or a piece doesn’t match, the browser gets the file from the gateway. Your visitors always get your file. At worst it comes from the gateway, as it would without operator nodes.

There’s no setting to turn this on or off. Whether operator nodes deliver your site’s files follows from its encryption level and its _headers and _redirects rules, as described below.

Which sites

Public (Level 0) sites only. Level 1 and Level 2 sites are always delivered by Regional Gateways: the network can’t read a Level 1 site’s contents, and a Level 2 site needs your backend to authorize each request. See encryption levels.
Sites whose rules don’t change what a node would deliver. A node delivers a file’s bytes and nothing else, so a rule that adds something to a file takes your site off operator nodes. See Your _headers and _redirects rules.
Sites with operator nodes near their visitors. Evolving Edge decides which operator nodes hold your site from where your visitors are, and removes the copies when demand drops. This is rolling out area by area. Where no operator node holds your site, a Regional Gateway delivers everything.

Which files

From operator nodes: the files your pages load from your own site, such as stylesheets, scripts, images and fonts.

Always from a Regional Gateway:

Pages (HTML), and anything a browser opens as a page of its own: frames and iframes, embedded documents, and web workers.
Very large files, over about 16 MB.
Requests for part of a file, such as seeking in a video.
A script or stylesheet whose stored type doesn’t match, for example a .js file stored as text/plain.
Paths that aren’t files: redirects, 404s, and directory addresses without an index.html.
Your _headers and _redirects files, which aren’t served to anyone.

Your `_headers` and `_redirects` rules

A file from an operator node carries none of the headers your rules set, and no redirect is applied to it. So the gateway checks your rules each time you deploy, and only lets operator nodes deliver your site where that makes no difference.

Headers

These headers are fine anywhere, and don’t affect delivery from operator nodes:

Content-Security-Policy and Content-Security-Policy-Report-Only
X-Content-Type-Options, Referrer-Policy, X-Frame-Options and Permissions-Policy
CORS headers (Access-Control-*)
Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy and Cross-Origin-Resource-Policy
Cache-Control, Content-Disposition, Link and Timing-Allow-Origin

Any other header set on a file that isn’t a page keeps your whole site on Regional Gateways. That includes a Content-Type override and Set-Cookie. Headers set only on pages never do. See Response headers.

A policy that restricts scripts. If your Content-Security-Policy limits which scripts may run, the gateway doesn’t add the script that connects browsers to operator nodes. Most operator nodes are behind a home router, and browsers reach them only through that script, so most or all of your files will come from Regional Gateways.

Redirects

Ordinary rules don’t matter. A rule without ! applies only where no file exists, and operator nodes deliver only files.
A forced rule (!) that matches a file a browser would otherwise fetch from an operator node keeps your whole site on Regional Gateways. Forced rules that match only pages, or only paths with no file, are fine. See Which rule wins.
# ee:trailing-slash on is fine. The paths it could redirect, those with no dot in the last segment, always come from a gateway.

Cache warming

Operator nodes connect to a page a moment after it starts loading, so on the first page of a visit most files still come from the gateway. Cache warming gets the next page ready instead.

Once a page has finished loading and is idle, the script looks at up to four pages of your site that it links to. It reads their HTML from the gateway and lists the files they use. It then fetches those files from operator nodes into the browser’s cache, so they’re ready if the visitor follows a link.

Files only. Warming fetches stylesheets, scripts, images and fonts from your own site. It never stores pages (HTML), video or audio, or any file over 1 MB.
Small. At most 2 MB per visit, counted over 30 minutes.
Never at the visitor’s expense. It doesn’t run when the visitor has asked to save data or is on a very slow connection, and it stops when they leave the page.
Checked like everything else. Every piece is checked against your site’s fingerprint before it’s stored.

Cache warming and your analytics

Warming doesn’t count as a visit in analytics that run in the page, and you can filter it out of analytics built from server logs.

Analytics that run in the page: nothing to do. This covers Google Analytics, Plausible, Fathom, Matomo’s tracking code, PostHog, Umami and Cloudflare Web Analytics. The linked pages warming reads are never displayed. Their scripts don’t run, so no pageview is recorded. The files it fetches are stored, not run, and only files from your own site are fetched, so a third-party tracking script or pixel is never requested.

Analytics built from server or proxy logs: filter by header. This covers a proxy or CDN in front of your domain, GoAccess, AWStats, and Matomo’s log import. Each linked page warming reads is a real request for that page, so it can appear in these logs: up to four extra page requests for a visit. Each one carries this request header:

X-EE-Prefetch: page

Filter out requests that carry it. Most log formats don’t record request headers by default, so you may need to add it to yours. If you can’t log custom headers, the browser’s standard request headers also tell the two apart:

Header	A visitor opening a page	A warming read
`Sec-Fetch-Mode`	`navigate`	`cors`
`Sec-Fetch-Dest`	`document`	`empty`

The files warming fetches come from operator nodes, not from your domain, so they never appear in your server’s logs.

Your Evolving Edge usage: bandwidth, not requests. The linked pages warming reads are sent by a Regional gateway, so their bandwidth counts in your usage. They aren’t counted as requests. The files warming fetches from operator nodes count as neither.

What keeps it safe

A node can’t change your files. Every piece is checked against your site’s fingerprint, which the browser gets from the gateway, not from a node. A piece that doesn’t match is discarded, and the browser asks the gateway.
Only public content. Operator nodes never deliver Level 1 or Level 2 sites.
Pages always come from a gateway, with your security headers, so a page’s Content-Security-Policy and framing rules always apply.

Checking your site

Every response for a Level 0 site carries an X-EE-Peerable header, which says whether operator nodes may deliver the site’s files:

curl -sI https://your-domain.example/styles.css | grep -i x-ee-peerable

Value	Meaning
`1` or `2`	Operator nodes may deliver your site’s files. `2` means some paths, such as those `# ee:trailing-slash on` could redirect, always come from a gateway.
`0`	Regional Gateways deliver everything. Check your `_headers` and `_redirects` rules above.

No header means the site isn’t Level 0.