GCDN Beta with Bot Protection
The GCDN Beta introduces built-in bot protection. Learn what's included, how to migrate, and what to expect.
The new GCDN provides the same caching and content delivery you rely on today, plus new security features built into the CDN layer.
What's Included
Bot Protection
Bot protection is enabled by default on all migrated sites. There is no additional configuration or cost required.
- Automated bot detection and scoring — Incoming traffic is automatically evaluated and scored. Requests identified as malicious receive managed challenges.
- Verified bot identification — Legitimate bots (such as Googlebot, Bingbot, and other search engine crawlers) are recognized and allowed through automatically. Unverified malicious bots are challenged.
Bot Exclusions
If your site relies on a custom bot or automated service that is not on the verified bot list, it may be challenged or blocked. Contact Pantheon support to request an exclusion for your bot's user agent.
After migrating to the GCDN Beta, monitor your automated integrations (CI/CD tools, feed importers, monitoring services, API clients) to ensure they are not being blocked. If a service stops working, check whether its user agent is being challenged and contact support to add an exclusion.
Client Challenges
When the GCDN identifies a request as potentially automated or malicious, it may present a challenge to the visitor. This is a non-intrusive verification that confirms the visitor is human before allowing access to your site.
Content Converter
Content Converter (Markdown for Agents) is enabled on all new GCDN zones. When a client sends a request with the Accept: text/markdown header, the CDN automatically converts the HTML response to Markdown in real time. This makes it easier for LLMs, AI agents, and other programmatic consumers to process your site's content without needing to parse raw HTML.
To request Markdown from a GCDN Beta site:
- This is enabled automatically on all GCDN Beta zones — no action is required.
- Standard browser requests (without the
Accept: text/markdownheader) are not affected and receive normal HTML responses. - The response includes an
x-markdown-tokensheader indicating the estimated token count of the Markdown document.
Caching
Caching behavior is the same as the current GCDN. Your existing caching configuration carries over without changes.
- The Pantheon Advanced Page Cache module (Drupal) and plugin (WordPress) work the same way. Granular, surrogate-key-based cache clearing is fully supported.
Cache-Controlheaders set by your application are respected.- Static assets are cached at the edge automatically.
- Tracking parameters (
utm_*,__*) are stripped from cache keys, consistent with current GCDN behavior (PANTHEON_STRIPPEDlogic). - Analytics cookies (Google Analytics, HubSpot, etc.) are excluded from cache key generation so they don't fragment your cache.
Eligibility
The Beta is open to most GCDN customers running Drupal or WordPress sites. The following configurations are not eligible at this time:
| Configuration | Reason |
|---|---|
| Advanced Global CDN (AGCDN) | Separate migration initiative |
| Custom Certificates | Special certificate management not yet supported |
| Multi-Zone Failover | Feature not available in Beta |
| Next.js / Front-End Sites (FES) | Not yet supported |
Setup
For the best experience, be prepared to update your DNS records as soon as possible after starting the migration. Delaying DNS migration can result in inconsistent behavior, as your site will remain on the old CDN infrastructure until DNS is pointed to the new GCDN.
FAQ
How do I know if my site is eligible?
Eligible sites will see a GCDN Beta banner on the site dashboard. If you don't see the banner, your site may fall into one of the excluded categories (AGCDN, Custom Certificates, Multi-Zone Failover, or FES). If you aren't sure about your eligibility, please reach out to Pantheon Support.
I have a Custom Certificate. Can I migrate?
Not yet. Custom certificate management is not supported in the Beta. This will be addressed before General Availability.
I use AGCDN. What should I do?
No action is required. AGCDN has its own migration initiative and timeline. Your current AGCDN configuration continues to work. AGCDN customers are excluded from the Beta.
What is the timeline for GCDN GA and new AGCDN?
GCDN GA is late Q2/Early Q3. AGCDN features will be moved to a new self managed AGCDN service beginning late Q2. As feature parity is reached, you will be contacted.
What changes when I migrate?
Your site's CDN infrastructure is upgraded to the next-generation GCDN. You get bot protection automatically. Caching behavior remains the same, including Pantheon Advanced Page Cache support. You will need to update your DNS records.
Do I need to change my application code?
No. The migration is transparent to your Drupal or WordPress application. No code changes are required.
Will my site have downtime during migration?
No. The migration process is designed to avoid downtime. During DNS propagation, traffic may temporarily alternate between the old and new CDN, but your site remains accessible throughout.
Does the Pantheon Advanced Page Cache module/plugin still work?
Yes. The Drupal module and WordPress plugin for Pantheon Advanced Page Cache work the same way on the new infrastructure. Surrogate-key-based cache clearing is fully supported.
What is Content Converter?
Content Converter (Markdown for Agents) is a feature enabled on all GCDN Beta zones. When a request includes the Accept: text/markdown header, the CDN converts HTML responses to Markdown in real time. This makes your site's content easier for LLMs and AI agents to consume. Standard browser traffic is not affected.
My automated integration stopped working after migration. What do I do?
Your bot or automated service may be receiving a managed challenge from bot protection. Check whether the service's user agent is being challenged by reviewing its error logs (look for 403 responses or HTML challenge pages). Contact Pantheon support to request a bot exclusion for your user agent.
I am using Cloudflare in front of my site. How does this work with the new GCDN?
The new Pantheon GCDN supports Orange-to-Orange (O2O) configurations, allowing you to keep your existing CDN or WAF rules in place. Your site's DNS entries must use CNAME records pointing to the Pantheon GCDN zone entries (e.g., fe1.cfp-us-central1-ch-1.edge.pantheon.io).
O2O is based on CNAME records. It does not apply when A/AAAA records are used for the DNS entry. Using A/AAAA records is not compatible with O2O and may result in site downtime or inaccessibility.
For more information on how O2O works, refer to the SaaS customer documentation.
We are actively testing this configuration during the Beta and welcome customer feedback in the #beta-gcdn channel in Pantheon Community Slack.
How do I report issues or give feedback?
Join #beta-gcdn in the Pantheon Community Slack to share feedback, report issues, or ask questions. You can also contact Pantheon support through the normal channels.