Stack playbook · Snapshot 23 October 2026
Adobe Experience Manager on Amazon CloudFront: readiness playbook
What 101 measured sites on this stack get right, where they fall short, and the Adobe Experience Manager on Amazon CloudFront-specific steps that close each gap.
- Sites measured
- 101
- Median readiness index
- 74/100
- Profiles on this stack
- 70
detected from homepage HTML and headers
all sites: 64
top-50K sites
Readiness by lane
Enable
86/100
All sites 77
Harden
70/100
All sites 56
Accelerate
65/100
All sites 64
Recover
28/100
All sites 10
The Adobe Experience Manager on Amazon CloudFront playbook
Gaps ordered by impact, with the platform-specific step where one exists.
Modern image formats in use
39% observed · all sites 40%
Serve WebP or AVIF with a JPEG or PNG fallback, either through an image CDN or by generating both formats at build time.
Guide: AVIF, WebP, JPEG, and PNG: Choose the Right Image Format
CAA records limit who can issue certificates
13% observed · all sites 13%
Publish CAA records naming every CA you actually use, including the CAs your CDN uses for managed certificates. Add an iodef contact if you want reports.
security.txt published
14% observed · all sites 7.1%
Publish /.well-known/security.txt with at least Contact and Expires fields, as RFC 9116 requires, and review it before it expires.
No render-blocking scripts in <head>
40% observed · all sites 48%
Add defer to scripts that need the DOM, async to independent ones such as analytics, or move them to the end of the body.
Guide: Control Third-Party Scripts Before They Control Your Page
Certificate lifetime of 100 days or less
3% observed · all sites 67%
Move to automated issuance and renewal now, while you still have time to test it.
HTTP/3 advertised
31% observed · all sites 37%
Turn on HTTP/3 at your CDN. Browsers fall back to HTTP/2 automatically, so the risk is low.
On Amazon CloudFront: Select HTTP/3 in the distribution's supported HTTP versions.
DNSSEC signed
12% observed · all sites 8%
Enable DNSSEC at your DNS provider, then add the DS record at your registrar. Plan provider moves carefully: a stale DS record can make the domain fail to resolve.
Guide: Website Uptime Readiness: Prepare Before Traffic Arrives
Static files cached for 30 days or more
57% observed · all sites 51%
Give versioned (fingerprinted) CSS, JavaScript, fonts and images Cache-Control: public, max-age=31536000, immutable, and change the file name whenever the content changes.
Where Adobe Experience Manager on Amazon CloudFront sites lead
- HSTS kept for at least a year84% observedall sites 34%
- X-Content-Type-Options: nosniff93% observedall sites 48%
- Framing restricted89% observedall sites 51%
- DMARC policy enforces quarantine or reject74% observedall sites 39%