DevSec Global redesigned a dynamic, origin-dependent web platform into a zero-origin, edge-served static architecture built on Cloudflare and AWS Lambda.
Instead of allowing user traffic to reach a PHP-based application layer, we isolated the origin entirely. AWS Lambda now securely fetches and processes content on a scheduled or triggered basis, while Cloudflare Workers, R2, and KV serve fully static, globally distributed assets directly from the edge.
The Challenge
We needed a solution when clients operated a dynamic PHP website that was performance-sensitive, traffic-exposed, and structurally vulnerable to attack patterns common to PHP-based systems.
The underlying problems were architectural:
Public origin server exposed to the internet
PHP execution on every request
Database dependency for page rendering
Plugin and framework attack surface
Scaling is tied to server capacity
Financial exposure to traffic spikes
Under load, the model deteriorates:
Traffic spikes increase CPU and DB load
Bot traffic consumes expensive dynamic resources
DDoS floods target application endpoints
Hosting costs rise with traffic
Availability becomes capacity-dependent
The business risk extended beyond uptime.
Convert dynamic, attack-prone websites into edge-served static sites that load instantly, scale infinitely, and stay online even under heavy traffic or attacks.
The traditional stack suffered from:
Performance Constraints
Centralized server rendering
Cold PHP execution
Database bottlenecks
Load balancer dependency
Regional latency
Security Exposure
Public origin server
WordPress/plugin vulnerabilities
SQL injection vectors
Credential stuffing
DDoS floods exhausting application logic
“You can’t hack what doesn’t exist.”
The challenge was not incremental optimization.
It was an architectural replacement.
The client required:
Sub-50ms global TTFB
Zero public origin exposure
No PHP execution on visitor requests
Elimination of database dependency for content delivery
Immunity to traffic spikes
Financial predictability under DDoS conditions
Infinite scalability without capacity planning
What did
Devsec Global did
We redesigned the delivery model from dynamic origin-based rendering to edge-served static architecture using:
Amazon Web Services Lambda
Cloudflare Workers
Cloudflare R2
Cloudflare KV
We can divide the project in a few steps:
1. Removed Public Origin Exposure
AWS Lambda was used exclusively for controlled content fetching and processing:
Securely scrapes content from WordPress/Laravel origin
Runs on schedule or trigger
Origin never exposed to the public
No direct visitor-to-origin traffic
Lambda performs:
Secure content extraction
Heavy processing logic
Controlled authentication
Scheduled rebuilds
This isolates dynamic complexity from user traffic.
2. Converted Dynamic Pages into Static Edge Assets
Dynamic rendering was eliminated from the user path.
Workflow:
Lambda fetches and processes origin content
Full HTML and assets stored in Cloudflare R2
Metadata, routing, headers stored in KV
Cloudflare Workers serve static pages globally
Result:
No PHP
No database
No runtime page generation
No backend hit during normal traffic
Sub-50ms TTFB globally
Content served from edge
No cold starts for users
3. Implemented Zero-Egress Cost Model
Traditional storage providers:
Charge per GB egress
Create financial exposure during spikes
Penalize viral traffic
Increase DDoS financial risk
Cloudflare R2:
No egress charges
Predictable storage + request pricing
Traffic volume does not affect bandwidth cost
Business impact:
1 TB traffic = €0 egress
10 TB = €0 egress
100 TB (viral or attack) = €0 egress
This directly eliminates a class of financial risk common in cloud-hosted environments.
4. Achieved Edge-Native Performance
Cloudflare Workers handle:
Routing
Header logic
Security enforcement
Caching rules
Version control
Performance gains:
No backend bottleneck
No centralized data center latency
No autoscaling delay
No load balancer complexity
Millions of requests per second
No capacity planning
No scaling logic
No infrastructure tuning
The architecture scales by design.
5. Eliminated Application Attack Surface
Security improvements became structural, and not reactive.
Removed components:
Public origin server
PHP runtime
WordPress execution layer
SQL database exposure
Plugin ecosystem vulnerabilities
Protected automatically by Cloudflare:
DDoS mitigation
WAF
Bot Management
Rate limiting
Immune to DDoS floods
Immune to WP exploits
Immune to SQL injection
Immune to credential stuffing
The attack surface was removed rather than hardened.
6. Increased Reliability & Uptime
No single point of failure
Site stays online even if origin is down
Ideal for campaigns and launches
Immune to traffic-induced outages
Traffic spikes no longer affect availability.
The Final Results
- Dynamic origin fully isolated from public traffic
- 100% of visitor requests served from Cloudflare edge
- Zero PHP execution or database queries on user requests
- No origin downtime during load spikes
- SDK delivered for native platforms, enabling Virtual & Live agent communications across multiple mobile platforms
- Eliminated server scaling, load balancers, and capacity planning