These settings limit what your configuration tells clients about your infrastructure, and which
requests reach your origin at all.

`deploymentNetworkTemplate`

{
  "name": "deploymentNetworkTemplate",
  "options": {
    "secureDeploymentNetwork": false
  }
}

Chooses between Akamai's two HTTPS security levels.

false — Standard TLS. Ships as this. A Level 1 certificate network: SOX and ISO compliant,
but not PCI or FedRAMP. Right for general web traffic, public sites, and content that doesn't
exchange PII. Edge hostnames use the edgesuite.net suffix.
true — Enhanced TLS. A Level 3 certificate network for high-assurance requirements: fully
PCI and FedRAMP compliant, best for PII, e-commerce, or financial data, and able to support non-SNI
configurations for legacy clients. Edge hostnames use the edgekey.net suffix.

Enhanced TLS depends on your contract. In the product definition, secureIncluded and
sharedCertSslIncluded tell you what your contract includes.

`allowMethodsTemplate`

{
  "name": "allowMethodsTemplate",
  "options": {
    "allowAllHttpInCacheHierarchy": true,
    "allowPost": true,
    "allowPostWithoutContentLength": false,
    "allowOptions": true,
    "allowPut": false,
    "allowPatch": false,
    "allowDelete": false
  }
}

GET and HEAD are always permitted — they're the standard content requests and aren't options
here. Everything else is explicit, and Akamai recommends keeping these values.

Option	Ships as	Why
`allowAllHttpInCacheHierarchy`	`true`	Permits all methods across cache-hierarchy parents, which SiteShield, SureRoute, and Tiered Distribution rely on. Tiered Distribution is on in this same template.
`allowPost`	`true`	Forwards `POST` to your origin; responses aren't cached. Without it, `POST` is denied with 403 Forbidden.
`allowPostWithoutContentLength`	`false`	Akamai normally requires `Content-Length` on `POST` and returns 411 Length Required without it, even for an empty body. Enabling this affects all write methods (`POST`, `PUT`, `PATCH`) in your default settings, so it ships off — turn it on only if your origin can handle requests whose body size isn't declared.
`allowOptions`	`true`	Browsers use `OPTIONS` to preflight. Blocked, it returns 501 Not Implemented — and full CORS support requires allowing `OPTIONS`, so disabling this breaks CORS silently. Responses aren't cached unless you use `constructResponse`.
`allowPut`	`false`	Write methods that modify origin content. Denied, they return 501 Not Implemented. Keeping them off prevents unauthorized or malicious modification of origin files. Enabling `PUT` also prevents caching for the affected requests.
`allowPatch`	`false`	As above.
`allowDelete`	`false`	As above. Setting it to `true` makes `allowDeleteWithBody` available (off by default).

`obfuscateBackendTemplate`

Recommended.

{
  "name": "obfuscateBackendTemplate",
  "options": {
    "debugHeader": "X-Akamai-Debug",
    "removeXPoweredByHeader": true,
    "removeServerHeader": true
  }
}

Removes response headers that disclose your origin software — the detail attackers use to match a
host against known vulnerabilities.

Option	Ships as	Why
`removeXPoweredByHeader`	`true`	Hides the technology stack (PHP, ASP.NET).
`removeServerHeader`	`true`	Hides the web server software and version (`Apache/2.4.41`).
`debugHeader`	`"X-Akamai-Debug"`	The escape hatch, prefilled so you don't have to invent one. When a request carries this header with the value `true`, `X-Powered-By` and `Server` are sent; otherwise both are removed. Change it to something private if you don't want its name to be guessable.

`httpsRedirectTemplate`

{
  "name": "httpsRedirectTemplate",
  "options": {
    "destinationHostname": "SAME_AS_REQUEST",
    "destinationPath": "SAME_AS_REQUEST",
    "queryString": "APPEND",
    "responseCode": 301
  }
}

Upgrades HTTP requests to HTTPS. The edge answers the client itself — your origin never sees the
request — building the redirect URL from these options.

❗️
This setting has no enable switch and no criteria
It's part of the default settings and applies to every request the configuration handles. With the
shipped values it's a clean HTTP-to-HTTPS upgrade that preserves the hostname, path, and query
string. Change destinationHostname or destinationPath only if you intend that redirect for
all traffic — a misconfiguration here is a redirect loop, not a degraded experience.

Option	Ships as	Why
`destinationHostname`	`SAME_AS_REQUEST`	The domain is unchanged, so the redirect only changes the scheme. `SUBDOMAIN` prepends a subdomain, `SIBLING` swaps the leftmost one, `OTHER` sends everything to a fixed hostname — each with a companion option for the value.
`destinationPath`	`SAME_AS_REQUEST`	The user lands on the page they asked for. `PREFIX_REQUEST` adds a prefix (and optionally a suffix); `OTHER` replaces the path entirely.
`queryString`	`APPEND`	Query parameters from the original request are carried over, so campaign and session parameters survive the upgrade.
`responseCode`	`301`	Moved Permanently, so clients and search engines remember the HTTPS URL and stop requesting the HTTP one. The behavior's own default is `302`; Ion overrides it because an HTTPS upgrade is permanent. Also available: `303`, `307`.