Adobe Commerce on Cloud ships Fastly as its CDN and full page cache, and you can extend it with custom VCL snippets, edge dictionaries, and ACLs from the admin. Done carefully, that lets you handle redirects, blocking, and header logic at the edge. Done carelessly, one bad snippet can take the whole storefront offline.
VCL is the configuration language Fastly runs at its edge nodes. The Magento-Fastly module already ships a full set of default snippets that make full page cache work; custom snippets layer your own logic on top. This guide covers the snippet model, the priority system that decides execution order, where dictionaries and ACLs fit, the safe clone-and-activate workflow, and the mistakes that cause outages. It assumes you are on Adobe Commerce on Cloud or a self-hosted Fastly setup, the two places this applies. For broader platform context, see our Magento development services.
Where Fastly sits on Adobe Commerce Cloud
On Cloud, Fastly is not optional glue. It is the full page cache. A request hits Fastly first; if the page is cached, Fastly serves it without ever touching Magento. That is why edge logic is so powerful here: you can redirect, block, rewrite headers, or route traffic before PHP runs at all. It is also why mistakes are dangerous, because a broken snippet affects every request, cached or not.
If you are weighing hosting models, this edge layer is one of the real differences between self-hosted Adobe Commerce and the SaaS version. Our guide to Adobe Commerce as a Cloud Service covers how the cloud editions differ, and how much of the stack you control.
Regular vs dynamic snippets
Fastly supports two kinds of custom VCL snippet, and the difference is operational, not cosmetic:
- Regular snippets are tied to a specific VCL version. You create and deploy them from the admin or the Fastly API, and their
dynamicvalue is0. Changing one means editing the VCL version and reactivating it. - Dynamic snippets are created through the Fastly API, with a
dynamicvalue of1. You can change and redeploy them without cutting a new VCL version, which makes them suited to data that changes often.
| Regular snippet | Dynamic snippet | |
|---|---|---|
dynamic value |
0 | 1 |
| Tied to a VCL version | Yes | No |
| Managed from admin | Yes | API only |
| Best for | Procedural logic: headers, routing, access control | Frequently changing rules, generated data |
| Redeploy cost | New VCL version | None |
For most storefront work, regular snippets managed from the admin are the right default. Reach for dynamic snippets when the logic itself is stable but the data behind it changes.
The snippet anatomy and the priority system
A snippet is a small JSON object with a handful of fields that matter:
name: a unique name for the snippet.type: where the snippet is inserted, such asinit(above subroutines) orrecv(inside the receive subroutine). Pick the type that matches the request phase your logic belongs in.priority: a value from 1 to 100 that controls execution order. Lower numbers run first. The default is 100.content: the VCL code itself. Sent through the API, it has to be on one line with special characters escaped.dynamic: 0 or 1, as above.
Priority is where teams get surprised. The default snippets shipped by the Magento-Fastly module run at priority=50. That gives you two useful positions around them:
- Priority 5 runs almost immediately, before the module defaults. This is where request routing belongs: block and allow lists, and redirects that should short-circuit everything else.
- Priority 100 runs after the defaults, which is the right place to override module behavior, because your code sees the state the defaults left.
Getting priority wrong is a common cause of “my snippet does nothing.” A redirect sitting at priority 100 can run after a cache lookup has already decided the response. Adobe’s custom VCL snippets documentation lists the full JSON field set and the priority rules, and the Magento Cloud VCL devdocs walk through concrete examples, including the default priority=50 baseline. If you are new to VCL structure itself, Fastly’s reference on VCL snippets explains where each snippet type is injected into the request lifecycle.
A fast way to confirm a snippet is actually running is to set a custom response header from it, then check the header on a live request. If the header is missing, the snippet never executed, which almost always traces back to priority or the wrong type for the request phase.
Edge dictionaries and ACLs: keep data out of code
Adobe recommends pairing snippets with two edge data stores rather than hardcoding values into VCL:
- Edge dictionaries hold key-value pairs your snippet reads. A redirect map, a feature flag, a list of country codes: all good dictionary candidates.
- Edge ACLs hold client IP addresses for allow or block rules. A snippet checks whether the request IP is in the ACL and returns a 403 if it should be blocked.
The reason this split matters is deployment. Dictionary and ACL data lives on the Fastly edge and can be updated across the network without redeploying VCL. So an office IP allowlist or a blocklist of abusive addresses can change in seconds, without touching a VCL version. If you have read our guide to managing bot traffic and rate limiting with Cloudflare, the ACL pattern here is the Fastly equivalent: block at the edge, before the request costs you anything.
Fastly Edge Modules sit above all of this: they let you create and upload common custom VCL from the admin with a form, instead of hand-writing and API-posting the VCL yourself. They are a good on-ramp before you start writing raw snippets.
The safe workflow: clone, edit, validate, activate
Never edit the live VCL version in place. The whole point of Fastly’s versioning is that you build a new version off the active one and promote it only when it validates. The workflow, whether through the admin or the API:
- Get the active version number for the Staging or Production service.
- Clone the active version to get an editable copy.
- Add or edit the snippet JSON against that cloned version.
- Validate the edited version.
- Activate it, which makes it live.
Two guardrails Adobe is explicit about:
- Verify the default Fastly configuration works first. Before you add any custom VCL, dictionaries, or ACLs, confirm the stock Fastly caching service is healthy. Debugging a custom snippet on top of a broken baseline wastes hours.
- Prove it on Staging. Cloud gives you a Staging environment with its own Fastly service ID. Upload and activate the snippet there, watch real traffic behavior, then replicate on Production. Treating edge changes like code deploys, tested before release, is the difference between a safe rollout and a sitewide incident.
This is the same discipline we apply to Varnish on self-hosted builds. Our guide to Magento full page cache and Varnish on Hyva covers the self-hosted equivalent, and the mental model carries over: the CDN is caching infrastructure you test, not a setting you toggle. Because Fastly fronts every request, it also caps your response time, so pair edge tuning with the server-side work in our guide to reducing Magento time to first byte.
Image optimization at the edge
Fastly Image Optimizer is a separate edge feature, not a VCL snippet, though VCL can support it. A common pattern is to extend the cache TTL for optimized images, for example holding images that pass through Image Optimizer for 30 days at the edge, since the source files rarely change. Image Optimizer handles format negotiation and resizing at the edge, which complements storefront-side work on next-gen formats rather than replacing it.
What this looks like on other platforms
Edge control is a dividing line between self-managed and SaaS commerce. On Adobe Commerce Cloud you get real VCL access. On fully managed platforms, the CDN is handled for you and you trade control for simplicity:
- Teams on Shopify development do not write VCL; Shopify manages its edge and CDN entirely.
- BigCommerce development and Shopware development similarly abstract the CDN layer, with far less low-level access than Fastly on Adobe Commerce.
Neither model is wrong. If your team wants edge-level control and has the skills to use it safely, Fastly on Adobe Commerce is a genuine advantage. If you would rather never think about VCL, a managed platform removes the footgun. The team at Bemeir works across all of these, and you can see our full technology partners ecosystem for the integrations that ride on top.
FAQ
What is custom VCL on Adobe Commerce?
Custom VCL is Varnish Configuration Language that Fastly runs at its edge nodes. On Adobe Commerce Cloud, Fastly is the full page cache, so custom VCL snippets let you redirect, block, route, and rewrite headers before a request reaches Magento. The Magento-Fastly module ships default snippets, and custom snippets layer your logic on top.
What is the difference between regular and dynamic Fastly snippets?
Regular snippets are tied to a specific VCL version and are managed from the admin or the API; their dynamic value is 0. Dynamic snippets are created through the Fastly API, have a dynamic value of 1, and can be updated without cutting a new VCL version. Use regular snippets for procedural logic and dynamic snippets for frequently changing rules.
What priority should a custom VCL snippet use?
The Magento-Fastly module’s default snippets run at priority 50. Use priority 5 for request routing like block and allow lists and redirects, so they run before the defaults. Use priority 100 to override default behavior, since it runs after the defaults. Lower priority numbers run first.
Do I need edge dictionaries and ACLs?
They are strongly recommended whenever your snippet references data. Edge dictionaries store key-value data and edge ACLs store IP addresses, both on the Fastly edge. Keeping data there lets you update allowlists, blocklists, and redirect maps without redeploying VCL.
How do I avoid breaking the site with a bad snippet?
Clone the active VCL version, edit the clone, validate it, then activate. Verify the default Fastly configuration is healthy before adding anything custom, and test every snippet on the Staging environment before replicating it on Production. Never edit the live version in place.
Build it with people who have shipped it
Edge configuration is powerful and unforgiving: the same snippet that blocks abusive traffic for free can take a storefront down if its priority or syntax is wrong. Bemeir is the USA’s first Hyva Gold Partner and an Adobe Commerce shop that runs Fastly on real production stores. Learn more about Bemeir or see our Hyva development services for the frontend work that sits behind the cache.
