Use these settings to minimize the information your website shares with clients and protect your infrastructure from unauthorized access or malicious threats.

Deployment Network Template

To secure content over HTTPS, Akamai offers two distinct security levels: Standard TLS and Enhanced TLS.

Standard TLS

Enabled by default, standard TLS uses a Level 1 (L1) certificate for secure HTTPS delivery. It is SOX and ISO compliant, but doesn't meet PCI or FedRAMP standards. Use it for general web traffic, public sites, and content that doesn't exchange Personally Identifiable Information (PII).

Standard TLS uses the edgesuite.net suffix for edge hostnames.

Enhanced TLS

Enhanced TLS uses a Level 3 (L3) certificate network engineered for high-assurance security requirements. It's fully PCI and FedRAMP compliant, which makes it best for sites handling sensitive data like PII, e-commerce transactions, or financial data. It also supports specialized non-SNI configurations for older legacy clients that don't send TLS SNI headers.

Enhanced TLS uses the edgekey.net suffix for edge hostnames.

Allowed Methods Template

This sub-rule defines which HTTP methods Akamai permits. GET and HEAD are enabled by default as they are standard for content requests. Akamai recommends keeping these at their default settings for optimal security.

Enable all HTTP methods on parent servers

Enabled by default, this allows the use of all HTTP request methods across cache hierarchy parents. This is particularly useful for features like SiteShield, SureRoute, and Tiered Distribution. In this architecture, the parent system acts as an intermediate caching layer between the edge servers (children) and the origin, reducing origin load and decreasing latency for end users.

To learn more, see Allow All Methods on Parent Servers.

Allow POST requests

Enabled by default, this forwards POST requests to the origin. However, because POST requests are typically used to send data rather than retrieve it, the responses are not cached. This setting controls whether the Akamai edge server allows HTTP POST requests to pass through to your origin. Normally, Akamai only honors GET, HEAD, and OPTIONS requests. When you don't specify this behavior at all or set it to Off ,any POST request received is denied with a 403 Forbidden response.

To learn more, see Allow POST.

Allow POST without Content-Length header

Disabled by default. Normally, Akamai requires a Content-Length header for all POST requests; otherwise, it returns a 411 Length Required error. This occurs even if the request has no body.

Enabling this option allows these requests to pass through without that specific header. If Content-Length is missing, the edge server looks for a Transfer-Encoding header to handle the data. If neither is found, the server assumes there is no message body and automatically adds a Content-Length: 0 header before forwarding the request to your origin.

This change affects all write-based methods (POST, PUT, PATCH) in your default configuration. Ensure your origin server is prepared to handle requests where the body size isn't explicitly defined.

To learn more, see Allow POST.

Allow OPTIONS requests

This setting controls how the Akamai edge server handles HTTP OPTIONS requests. Modern browsers frequently use this method to check server capabilities and permissions before sending actual requests.

Enabled by default, this allows OPTIONS requests to pass through to your origin. These responses are not cached unless you specifically use the Construct Response behavior. If you set this to Off, these requests are blocked and servers return a 501 Not Implemented response.

To learn more, see Allow OPTIONS.

Allow PUT, PATCH, DELETE methods

Disabled by default (Recommended).

Unless enabled, requests using these methods result in an 501 Not Implemented response.

• PUT. Used to update or replace resources. Enabling this prevents caching for the associated request.
• PATCH/DELETE. Used to delete or partially modify existing resources.
  Keep these disabled to prevent unauthorized or malicious modifications to your origin files.
• DELETE with body. Disabled by default. Enable to include data in the request body.

To learn more, see Allow PUT, Allow PATCH, and Allow DELETE respectively.