Black-box cache and CDN audit

A cloud origin bill rising with no explanation, behind a CDN that "should be holding the load". Nobody can say what the real hit ratio is, and access to the client's dashboard isn't always available at the start of the engagement.

An audit that uses only public HTTP headers — zero credentials, zero access to the infrastructure. A sample stratified by content age, drawn with a fixed seed from the sitemaps, and three controlled passes over the same URLs:

1. cold measurement,
2. immediate measurement,
3. measurement after the declared TTL expires.

The design is self-controlled: it separates "cold cache" (a sampling artifact that invalidates most cache audits) from "expired TTL" (a real defect), and that conclusion doesn't depend on which PoP served the request. Auxiliary tests cover query strings in the cache key, conditional revalidation (304), content negotiation, session cookies and no-store routes.

The reference case isolated two defects that compounded each other: a TTL too short for the content type, and Last-Modified filled with the render timestamp — which eliminates cheap revalidation and makes every expiration cost a full render plus the entire HTML transferred from the origin. The two highest-impact fixes were dashboard configuration, no deploy.

The method became an executable skill (auditoria-cache-cdn), with its own roadmap and output as a technical and an executive report — reapplicable to any domain without redoing the reasoning.

Solo authorship of the method, the probes and the reports.