JD Sports Replaces Legacy Infrastructure to Secure Agentic Commerce with Fastly
Key Takeaways
Consolidated edge infrastructure by displacing both an incumbent CDN and a legacy bot protection vendor into a single, unified security platform.
Migrated 120 web properties for CDN and WAF in less than two weeks with zero downtime and zero operational issues.
Blocked over 1.31 billion malicious requests and automated attacks in a single month through Next-Gen WAF edge deployment.
Embraced the future of agentic commerce by utilizing Fastly Bot Management to granularly rate-limit aggressive AI crawlers without issuing hard blocks, protecting both origin stability and digital conversion metrics.
De-risked a massive architectural re-platforming program using an edge-based Broker Service to split traffic iteratively.
Co-engineered a real-time automated response loop via Fastly's Managed Security Service Enterprise to instantly secure potentially compromised user accounts.
The Challenge
JD Sports is a leading global sports fashion retailer managing a multi-billion dollar empire with more than 4,850 stores across 49 countries. As the company expanded through major global acquisitions—with the US market scaling to represent 60% of its total business—the digital storefronts became lucrative targets for sophisticated bad actors.
Historically, JD Sports operated on a homegrown, multi-tenanted monolithic e-commerce infrastructure. Under this architecture, automated bot attacks directed at a single storefront could cascade, overwhelm origin resources, and pull down the entire global portfolio. This operational vulnerability created massive revenue risk.
To defend its ecosystem, the company deployed a fragmented stack with separate vendors for content delivery and bot protection. Over time, this setup yielded high false-positive rates that frustrated internal staff and offered slow, rigid security responses during high-profile product drops. JD Sports needed a developer-first, unified edge platform to automate threat defense and support the transition to a modern, composable architecture.
The Solution
To eliminate technical overhead, JD Sports executed a total platform takeover, routing their massive global traffic volume through Fastly. By aligning with Fastly's agile deployment methodology, the combined teams successfully transitioned more than 120 distinct domain names in a matter of days.
“The actual work that Fastly did to ensure that we could move 110 domain names in the space of a week and a half, two weeks ... That's probably a world record. It's a huge undertaking and with zero downtime as well. That just gives you an idea of what can be achieved if you go in with the right mindset,” noted Shoyab Patel, Head of Service Lifecycle, JD Sports. “The Fastly team pulled out all the stops to get us moved over.”
Mitigate massive Account Takeover (ATO) fraud
JD Sports integrated Fastly’s Managed Security Service Enterprise directly into internal operations. The Fastly CSOC monitors critical endpoints, such as user login pages, in real time. When credential stuffing or account takeover activity occurs, Fastly’s CSOC instantly identifies the threat activity and triggers automated workflows to lock affected accounts and force immediate password resets. This seamless collaboration prevents malicious actors from misusing hijacked credentials.
Enable seamless cloud migration
As part of a complete digital transformation away from their legacy platform setup, JD Sports engineered an edge-based broker service on Fastly VCL. This routing logic allows the engineering team to transition users to the new architecture incrementally—starting at 10% of traffic, then scaling to 20%, 30%, and beyond—while continuously checking performance data. To prevent organic search disruption, the service pinned critical search engine indexers and AI bots strictly to the legacy environment until the new site was fully optimized and ready for a global cutover.
Normalize aggressive AI scrapers without a hard block
Unlike traditional media entities that view AI scrapers as an existential threat, JD Sports views agentic commerce and AI crawlers as the natural evolution of internet search. However, when aggressive AI bots from one organization began hitting the platform 18 million times a day—compared to Googlebot's standard 1,800 daily visits—the traffic threatened origin stability and heavily skewed digital conversion metrics. By leveraging Fastly Bot Management, JD Sports gained the granular visibility required to identify specific AI user-agent strings and Autonomous System Numbers (ASNs). Rather than issuing an absolute block, JD Sports applied specific rate limits, balancing platform protection with future AI readability.
“In retail cybersecurity, protecting customer trust and maintaining platform integrity is paramount. Having strong, automated defenses in place lets us proactively stay ahead of threats,” Shoyab added. “To give you some testament as to how effective it’s been, our team has probably reached out to me once or twice in our relations with Fastly to ask questions. That just gives you a bit of flavor of the efficacy that we’re seeing from the Bot Management product.”
Key Takeaway
With the execution of this UK-focused enterprise deployment, Fastly successfully anchored the core of JD Sports' modern front-end ecosystem. As the company continues to sunset its monolithic infrastructure and scale out its composable architecture, the long-term roadmap focuses on leveraging Fastly's global network presence across the remainder of their global brands and international digital properties.