Use these settings to minimize the information your website shares with clients and protect your infrastructure from unauthorized access or malicious threats.

Deployment Network Template

To secure content over HTTPS, Akamai offers two distinct security levels: Standard TLS and Enhanced TLS.

Standard TLS

Enabled by default, standard TLS uses a Level 1 (L1) certificate for secure HTTPS delivery. It is SOX and ISO compliant, but doesn't meet PCI or FedRAMP standards. Use it for general web traffic, public sites, and content that doesn't exchange Personally Identifiable Information (PII).

Standard TLS uses the edgesuite.net suffix for edge hostnames.

Enhanced TLS

Enhanced TLS uses a Level 3 (L3) certificate network engineered for high-assurance security requirements. It's fully PCI and FedRAMP compliant, which makes it best for sites handling sensitive data like PII, e-commerce transactions, or financial data. It also supports specialized non-SNI configurations for older legacy clients that don't send TLS SNI headers.

Enhanced TLS uses the edgekey.net suffix for edge hostnames.

Allowed Methods Template

This sub-rule defines which HTTP methods Akamai permits. GET and HEAD are enabled by default as they are standard for content requests. Akamai recommends keeping these at their default settings for optimal security.

Enable all HTTP methods on parent servers

Enabled by default, this allows the use of all HTTP request methods across cache hierarchy parents. This is particularly useful for features like SiteShield, SureRoute, and Tiered Distribution. In this architecture, the parent system acts as an intermediate caching layer between the edge servers (children) and the origin, reducing origin load and decreasing latency for end users.

To learn more, see Allow All Methods on Parent Servers.

Allow POST requests

Enabled by default, this forwards POST requests to the origin. However, because POST requests are typically used to send data rather than retrieve it, the responses are not cached. This setting controls whether the Akamai edge server allows HTTP POST requests to pass through to your origin. Normally, Akamai only honors GET, HEAD, and OPTIONS requests. When you don't specify this behavior at all or set it to Off ,any POST request received is denied with a 403 Forbidden response.

To learn more, see Allow POST.

Allow POST without Content-Length header

Disabled by default. Normally, Akamai requires a Content-Length header for all POST requests; otherwise, it returns a 411 Length Required error. This occurs even if the request has no body.

Enabling this option allows these requests to pass through without that specific header. If Content-Length is missing, the edge server looks for a Transfer-Encoding header to handle the data. If neither is found, the server assumes there is no message body and automatically adds a Content-Length: 0 header before forwarding the request to your origin.

This change affects all write-based methods (POST, PUT, PATCH) in your default configuration. Ensure your origin server is prepared to handle requests where the body size isn't explicitly defined.

To learn more, see Allow POST.

Allow OPTIONS requests

This setting controls how the Akamai edge server handles HTTP OPTIONS requests. Modern browsers frequently use this method to check server capabilities and permissions before sending actual requests.

Enabled by default, this allows OPTIONS requests to pass through to your origin. These responses are not cached unless you specifically use the Construct Response behavior. If you set this to Off, these requests are blocked and servers return a 501 Not Implemented response.

To learn more, see Allow OPTIONS.

Allow PUT, PATCH, DELETE methods

Disabled by default (Recommended).

Unless enabled, requests using these methods result in an 501 Not Implemented response.

• PUT. Used to update or replace resources. Enabling this prevents caching for the associated request.
• PATCH/DELETE. Used to delete or partially modify existing resources.
  Keep these disabled to prevent unauthorized or malicious modifications to your origin files.

To learn more, see Allow PUT, Allow PATCH, and Allow DELETE respectively.

Obfuscate Backend Template

Recommended

This setting removes headers that reveal specific details about your origin software, which attackers often use to identify known vulnerabilities.

• Debug header. Specifies the debug header to apply these protections. By default, when this header's value is true, this sends the X-Powered-By and Server headers in the response. If the header you specify is absent or the value is other than true X-Powered-By and Server headers are removed.
• Remove X-Powered-By header. Automatically removed to hide the technology stack powering your origin, such as PHP or ASP.NET.
• Remove Server header. Automatically removed to hide the specific web server software and version. For example, Apache/2.4.41.

HTTPS Redirect Template

This setting instructs edge servers to respond directly to a user's request with a redirect, entirely bypassing your origin. The system constructs a redirect URL based on your configuration, selects the specified HTTP status code, and sends it back to the client browser.

Set the options

• Destination. Define how the domain portion of the URL should change:
  • Same as request. Selected by default, keeps the domain unchanged.
  • Add subdomain to request. Lets you prepend a subdomain (e.g., changing example.com to m.example.com).
  • Substitute requested subdomain. Swaps out the existing leftmost subdomain.
  • Static hostname. Redirects to an entirely different, fixed domain.
• Destination Path. Choose how to modify the rest of the URL path:
  • Same as requested. Forwards the exact path to the new destination.
  • Path Prefix and Suffix. Allows you to prepend or append specific directories/strings to the existing path.
  • Static path. Replaces the entire requested path with a fixed URL path.
• Include Query String. Determines whether the query parameters from the user's original request are carried over and appended to the new destination URL. Enabled by default.
• Redirect status code. Select the HTTP status code returned to the client:
  • 301 Moved Permanently
  • 302 Found
  • 303 See Other
  • 307 Temporary Redirect

HTTP Strict Transport Security (HSTS)

Disabled by default. Enable to improve security by requiring all browser connections to use HTTPS rather than HTTP.

HSTS instructs the browser to use HTTPS when making requests to your website. The browser remembers this instruction for an amount of time that you set, so the next time a user visits your website, their browser will use HTTPS.

To learn more, see HTTP Strict Transport Security (HSTS).