What 1PrimeCDN is
1PrimeCDN copies your website's files (images, CSS, JavaScript, videos, PDFs) to its nodes, called PoPs, and serves them to visitors from the nearest node. Your site loads faster and your server does much less work.
It works on a «pull» basis: the first time a file is requested, the PoP downloads it from your server (the origin) and keeps it in cache. Later requests are served directly by the PoP.
You pay a fixed monthly fee: Start €9.90 up to 1 TB, Scale €24.90 up to 5 TB, Unlimited €50 with no GB counting (up to 200 Mbit/s). No per-request fees and no bill adjustments. The European nodes come with every plan; the nodes outside Europe are the «Global network» add-on, €24.90 a month.
Creating your first Pull Zone
- Go to Pull Zone and press «+ Add Pull Zone».
- Choose a name (lowercase letters, numbers and hyphens): it becomes the address name.primecdn.it.
- Enter the full address of your site, for example https://www.mysite.com. This is the origin 1PrimeCDN downloads the files from.
- Press «Create Pull Zone». The zone is active right away.
From now on a file like https://www.mysite.com/images/photo.jpg is also available at https://name.primecdn.it/images/photo.jpg.
Using your own domain (e.g. cdn.mysite.com)
- Open the Pull Zone and go to «Hostnames and SSL».
- In your domain's DNS panel create a CNAME record: name «cdn», target the zone address (name.primecdn.it).
- Go back to 1PrimeCDN, type cdn.mysite.com and press «Add».
- After a few minutes press «Verify»: once the CNAME is correct, the HTTPS certificate is issued automatically and for free.
cdn.mysite.com. 3600 IN CNAME name.primecdn.it.
DNS changes can take anywhere from a few minutes to a few hours. If «Verify» says the CNAME does not point to the zone yet, try again later.
Connecting the CDN to your site
For visitors to use the CDN, the addresses of your site's images and static files must point to the CDN domain.
- WordPress: with a cache plugin (for example WP Rocket, W3 Total Cache or CDN Enabler) enter https://cdn.mysite.com as the «CDN URL».
- PrimeNews24: the automatic integration (images from the CDN and a purge on every publication) is coming soon; in the meantime use the API.
- Hand-built sites: replace the domain in the addresses of images, CSS and JS.
To check that it works, open an image from the CDN and look at the X-Cache header: MISS the first time, HIT from then on.
DNS: managing your domains on 1PrimeCDN
With 1PrimeCDN DNS you manage all of a domain's records from the panel and can put any subdomain on the CDN with one click, including the main domain.
- Go to DNS, type the domain (without www) and press «Add domain».
- Check the imported records: site, www, mail (MX) and verifications (TXT). Add any that are missing.
- At your registrar (where you bought the domain) replace the nameservers with the ones shown in the panel.
- After a few hours press «Check nameservers»: when the status becomes «DNS active» the switch is complete.
- «On CDN» (on A, AAAA and CNAME): visitors reach the 1PrimeCDN PoPs, which fetch the content from your server. The pull zone and HTTPS certificate are created automatically.
- «DNS only»: the name answers directly with your server's address, like a normal DNS.
- A CNAME must be the only record for its name and cannot be used on the main domain (@): use an A record there, or turn on the CDN.
Before changing the nameservers, double-check the MX and TXT records: if they are missing, the domain's email stops arriving.
Cache rules
- Cache time on PoPs: how long the PoP keeps a file before requesting it from the origin again. «Respect origin headers» uses the instructions sent by your server.
- Browser cache time: how long the visitor's browser reuses the file without requesting it again.
- HTTPS: as soon as the certificate is active, visitors arriving over http are redirected to https automatically. Certificates renew on their own.
- Ignore query string: ?v=2 or ?w=800 do not create different copies of the same file. Keep it on, unless your site generates different images based on the parameters.
- Compression: HTML, CSS, JS and SVG are sent compressed.
- Serve stale copy if the origin does not respond: if your server is down, visitors keep seeing the files already in cache.
- Cache responses with cookies: leave it off if the site has pages with user login. When off, pages requested with a cookie always go to the origin, while CSS, JavaScript, images and fonts stay cached for everyone. Requests with an Authorization header (APIs with a key) never go through the cache.
Changes reach all PoPs in about 20 seconds.
Purging the cache
When you change a file but keep the same name, purge the cache so the PoPs download the new version.
- By URL: in the Pull Zone paste one or more addresses, one per line, and press «Purge these URLs».
- Whole zone: the «Purge cache» button at the top of the Pull Zone.
- From code: with the API (see below), for example on every CMS publication.
- WordPress: the 1PrimeCDN plugin (pannello.1primecdn.com/1primecdn-wordpress.zip) caches the pages and purges them on its own at every publication. Activate it, paste the API key in Settings → 1PrimeCDN, pick the pull zone and press «Prepara la pull zone per WordPress» (the plugin is in Italian for now).
The purge runs on all PoPs within a few seconds; the history is in the right-hand column of the Pull Zone.
Once the purge is done the panel asks your server for the page: if it answers from a cache of its own (Next.js, Varnish, LiteSpeed, a caching plugin or another CDN in front), it tells you. In that case the PoPs reload the same old version until you clear that cache too: purge the site first, then the CDN.
API
- Go to «API and keys», give the key a name and press «Create key».
- Copy the key right away: for security it is not shown again.
GET /api/v1/pullzones
POST /api/v1/pullzones {"name": "client-site", "originUrl": "https://www.site.com", "hostnames": ["cdn.site.com"]}
GET|PATCH|DELETE /api/v1/pullzones/<ID> PATCH {"status": "PAUSED"}
POST /api/v1/pullzones/<ID>/purge {"urls": ["https://cdn.mysite.com/photo.jpg"]}
POST /api/v1/pullzones/<ID>/purge {"all": true}
Header: Authorization: Bearer pcdn_…If a key ends up in the wrong hands, press «Revoke»: it stops working immediately.
Credit and billing
- You choose your plan in Billing → Your plan. The fee is deducted from your prepaid credit on the 1st of the month; the first month is charged in proportion to the days remaining.
- Traffic used against traffic included is shown live in the «Usage» box: the bar turns amber at 80% and red once you are over.
- If you exceed your plan's traffic no adjustment lands on your invoice: we write to you and from the 1st of the next month you move up a plan. If you would rather stay where you are, just tell us.
- Moving up a plan takes effect at once, with the fee in proportion to the days remaining. Moving down takes effect on the 1st of next month, because the current month is already paid for.
- On the 1st of the month you get the statement for the previous month: you'll find it in «Monthly statements», to print or save as PDF.
- If in a month we missed the guaranteed availability (99.9%), we credit the penalty ourselves when the month closes: you do not have to claim it and you do not have to prove a loss. It appears as a line on your statement and goes back onto your credit. It is 10% to 100% of the month's fee depending on how far below we were; if more than one zone had an outage, the worst one counts.
- When your credit is about to run out you get an email. When the credit is used up, Pull Zones are suspended; after a top-up they restart on their own in less than a minute.
- «Credit transactions» lists top-ups, plan fees and free credits. The electronic invoice is sent via SDI by Prime Server S.r.l.
- Accounts opened before the plans existed stay on pay-as-you-go at their own price per GB: nothing changes until they pick a plan.
- Coming soon: card payment.
Redirecting a domain
For a domain that should only lead to another site (an old name, a typo, a defensive brand registration) you don't need a server: the Pull Zone answers with a permanent 301 redirect, with automatic HTTPS.
- Pull Zone → Origin → «Redirect»: enter the destination address, for example https://www.mysite.com.
- Path and parameters stay the same: /page?x=1 becomes https://www.mysite.com/page?x=1.
- With DNS on 1PrimeCDN: put the domain's @ and www records on the CDN (the record's IP doesn't matter) and set the redirect on the two Pull Zones created.
- Leave the field empty to go back to fetching from the origin.
In Performance choose a Pull Zone and press «Run benchmark». In about a minute 1PrimeCDN downloads the site's pages and files three times from your server (without the CDN) and three times from the CDN, from the panel and from every PoP.
- Time to first byte (TTFB): how long the visitor waits before the response starts to arrive. It is the number that matters most for perceived speed.
- First time (MISS): the first request to the CDN still goes to your server; from the second one on, the file comes from the cache.
- Served from cache: the percentage of repeated requests served by the PoPs. If it is low, read the suggestions below the results.
- If you don't specify any pages, the benchmark measures the home page and up to 4 images, CSS and JavaScript files found on it. You can enter the paths yourself, separated by spaces.
Seeing your visitors' real IP
With the CDN, your server receives requests from the 1PrimeCDN nodes: without a setting, statistics and logs show the node's IP and city (e.g. Falkenstein) instead of the visitor's. The real IP arrives in two headers: X-Forwarded-For and X-PrimeCDN-Client-IP (the IP only, like Cloudflare's CF-Connecting-IP). Your server should trust these headers only when the request comes from a 1PrimeCDN node.
- Nginx: in Pull Zone → Origin you'll find the command that installs the list of nodes and updates it every hour on its own.
- Apache: in Pull Zone → Origin you'll find the configuration for the remoteip module (a2enmod remoteip), ready to paste; always up to date at /api/public/apache-remoteip.
- PHP and WordPress on shared hosting: in Pull Zone → Origin you'll find 6 lines to paste into wp-config.php, with the list of nodes already included.
- Always up-to-date list of nodes: https://pannello.1primecdn.com/api/public/ips (one per line) and /api/public/nginx-realip (ready-made Nginx configuration).
Edge Storage: we keep the files
If you have no server to pull files from — or would rather not use it for images, PDFs, fonts and video — create a storage zone: you upload the files here and the nodes serve them. You choose it when creating the Pull Zone, with «We keep the files».
- Edge Storage → New storage zone (or Pull Zone → Add, picking «We keep the files»), then name the zone. The Edge Storage page sums up your storage zones, files and space used.
- In the «Files» tab upload whatever you want, in folders if you like.
- Every file is immediately reachable at https://zone-name.1primecdn.com/path/to/file.jpg, and from then on the nodes serve it.
- Space included: 1 GB pay-as-you-go, 2 GB with Start, 10 GB with Scale, 25 GB with Unlimited. You see how much you use at the top of the «Files» tab.
- From the panel you can upload files up to 9 MB each; through the API up to 100 MB.
- If you replace a file with the same name, the old copy is removed from the nodes on its own: there is nothing to purge.
- Images on the fly work here too: ?w=800 or ?f=webp apply to storage files just as they do to files on your own server.
- Path rules and signed URLs work normally as well: a storage zone is a Pull Zone like any other, only the origin is us.
From a shell or a program you use your API key (Settings → API keys):
# upload a file
curl -X PUT -H "Authorization: Bearer YOUR_KEY" \
-H "Content-Type: image/jpeg" \
--data-binary @photo.jpg \
https://pannello.1primecdn.com/api/v1/storage/ZONE_ID/images/photo.jpg
# list files and space used
curl -H "Authorization: Bearer YOUR_KEY" \
https://pannello.1primecdn.com/api/v1/storage/ZONE_ID
# delete
curl -X DELETE -H "Authorization: Bearer YOUR_KEY" \
https://pannello.1primecdn.com/api/v1/storage/ZONE_ID/images/photo.jpgStorage files live in the European Union and are part of our nightly backup, with a copy on a second server. The nodes keep a cached copy, as they do for any other site.
Path rules
By default the cache settings apply to the whole site. In Pull Zone → Path rules you can say that one part behaves differently: /api/ never cached, /static/ for a year.
- You give only the start of the path, with no wildcards: the rule applies to everything inside it.
- If several rules match, the longest path wins: /api/v2/ beats /api/.
- Each rule decides the time on the nodes, the time in the browser and whether query parameters count; anything left on «same as the rest of the site» keeps the zone's setting.
- With the cache turned off by a rule, the response carries X-Cache: BYPASS.
- Images on the fly keep working inside a path that has a rule.
Access log
In Pull Zone → Access log you switch on the collection of rows: one for every request served by the nodes, with date and time, the visitor's IP address, the address requested, the outcome, bytes, whether it came from cache, the node that answered, the country, the referrer and the browser.
- It is off by default and switched on site by site: those rows contain visitors' IP addresses.
- One file per day, compressed, downloadable from the panel or the API.
- Rows are kept for 7 days and then deleted on their own. Switch the log off and the rows already collected are deleted at once, all of them.
- The format is one JSON row per request: read it with `zcat file.log.gz | jq` or import it wherever you like.
# the days available
curl -H "Authorization: Bearer YOUR_KEY" \
https://pannello.1primecdn.com/api/v1/logs/ZONE_ID
# a whole day
curl -H "Authorization: Bearer YOUR_KEY" \
"https://pannello.1primecdn.com/api/v1/logs/ZONE_ID?day=2026-10-16" | zcatIt is useful to you as well: this is the same data we measure your site's availability with, for the SLA. If a figure does not add up, you have it in front of you.
The nodes and the global network
Your site is served by the European nodes: they come with every plan and there is nothing to switch on. A visitor from Italy, France or Poland lands on one of them.
The nodes outside Europe are the «Global network» add-on (Billing, €24.90 a month). With it on, someone visiting your site from Asia is served from the Mumbai node, someone visiting from North America from the Beauharnois node and someone visiting from Oceania from the Sydney node, instead of from Europe: from Asia that is about 130 milliseconds less travel per round trip, and a page makes many of them. Without it your sites stay on the European nodes and nobody notices a thing.
- It starts at once and for the first month you only pay the remaining days; it ends on the 1st of the following month, so you do not lose the month you have already paid for.
- Visitors from a continent where we have no node are served from Europe. If the node for their continent stops answering, they fall back to Europe on their own within seconds.
- In Pull Zone → Advanced you can see which nodes serve each site and leave some out (for example to keep the traffic inside the European Union). The «Nodes in the European Union only» checkbox also accounts for nodes we add later.
The node is chosen in DNS, from the continent the request comes from: there is nothing to configure in your site.
Security (1PrimeCDN Shield)
1PrimeCDN Shield protects your Pull Zones automatically. On every node it checks the traffic every 10 seconds and gives each IP a score: anyone making too many requests, bypassing the cache with ever-changing addresses or looking like an automated program is first sent a challenge and, if it keeps going, blocked for a few minutes.
- Report (Security → Overview): for the last 24 hours, 7 or 30 days and for each zone you see how many requests Shield analysed and stopped, a chart by hour or by day split by type (too fast, challenge, blocked country), which countries the stopped requests come from and the IPs stopped most often, with the reason.
- Never challenged or blocked: verified search engines (Google and Bing, from their official lists updated daily) and each Pull Zone's origin server on its own zone, even when it reads many pages at once.
- Challenge: a one-second page that the browser passes on its own. After that, the visitor browses normally for 12 hours.
- Block: 10 minutes the first time, then double each time it happens again, up to 24 hours. No block is permanent.
- «Under attack» mode (Security → Overview, the zone's switch): every visitor to the pages goes through the challenge and the site stays only on the nodes whose provider filters network attacks. Use it only during an attack: verified Google and Bing crawlers still get through, but social previews, feed readers and monitoring services are stopped.
- IP rules: block an IP or a network on one of your zones, or always allow it (offices, services that query the site often). Each rule has a reason and a duration.
- Countries (Security → Countries): one click on a country moves it from allowed to «challenge» (soft block: a one-second challenge, then browsing continues) to «blocked» («Site not available»). For the «highest risk» and «medium risk» groups there is an Allow · Challenge · Block selector. The groups never include Italy, the European Union, Switzerland, the United Kingdom, the United States or Canada.
- Firewall (Security → Firewall): rules managed by 1PrimeCDN that stop the most common attempts against your site: paths outside the folder (../), files that are never served (.git, .env), SQL injection, XSS, command execution, Log4Shell and Shellshock, known scanners and unused HTTP methods. You choose zone by zone: Off, Log only or Block (403 error).
- How to switch it on: start with «Log only» for a few days, to see whether any real visitor would have been stopped, and only then move to «Block». If one family gives false alarms, untick that one only.
- What it does not do: it looks at the address, headers (User-Agent, Referer, X-Forwarded-For) and method, but not the body of POST requests, and it does not use the OWASP CRS rules. It is a basic defence, not a replacement for a full WAF. IPs under «Always allow» still pass.
Protection against the largest network attacks (the ones that clog the line) is handled by the data center infrastructure, OVH and Hetzner; Shield takes care of web traffic.
Password and account
- To change your password, click your name at the top right («Your account»). After the change, sessions open on other devices are closed.
- Forgot your password: on the login page press «Forgot password?» and you'll get an email with a link valid for one hour.
- The password must be at least 10 characters long: a long phrase is better than a complicated word.
- Language: the panel is available in Italian and English. Switch it with the IT/EN selector at the top (or on the login page and in «Your account»): it applies to the browser you're using.
Statistics and network
- Dashboard and Statistics: bandwidth served, bandwidth requested from the origin, requests and hit ratio (percentage served from cache) by zone and by PoP.
- Infrastructure: world map with the PoPs and their status (a node that hasn't reported in for more than 2 minutes shows as offline); staff also see load, memory, disk, connections and bandwidth for each node.
A hit ratio below 85% usually means files with a cache time that is too short or varying query strings: Prime AI flags this on the dashboard.