Stack playbook · Snapshot 23 October 2026
Adobe Experience Manager: readiness playbook
What 456 measured sites on this platform or framework get right, where they fall short, and the Adobe Experience Manager-specific steps that close each gap.
- Sites measured
- 456
- Median readiness index
- 71/100
- Profiles on this stack
- 306
detected from homepage HTML and headers
all sites: 64
top-50K sites
Readiness by lane
Enable
87/100
All sites 77
Harden
69/100
All sites 56
Accelerate
59/100
All sites 64
Recover
23/100
All sites 10
The Adobe Experience Manager playbook
Gaps ordered by impact, with the platform-specific step where one exists.
Modern image formats in use
29% observed · all sites 40%
Serve WebP or AVIF with a JPEG or PNG fallback, either through an image CDN or by generating both formats at build time.
Guide: AVIF, WebP, JPEG, and PNG: Choose the Right Image Format
No render-blocking scripts in <head>
27% observed · all sites 48%
Add defer to scripts that need the DOM, async to independent ones such as analytics, or move them to the end of the body.
Guide: Control Third-Party Scripts Before They Control Your Page
CAA records limit who can issue certificates
16% observed · all sites 13%
Publish CAA records naming every CA you actually use, including the CAs your CDN uses for managed certificates. Add an iodef contact if you want reports.
security.txt published
16% observed · all sites 7.1%
Publish /.well-known/security.txt with at least Contact and Expires fields, as RFC 9116 requires, and review it before it expires.
Static files cached for 30 days or more
48% observed · all sites 51%
Give versioned (fingerprinted) CSS, JavaScript, fonts and images Cache-Control: public, max-age=31536000, immutable, and change the file name whenever the content changes.
HTTP/3 advertised
24% observed · all sites 37%
Turn on HTTP/3 at your CDN. Browsers fall back to HTTP/2 automatically, so the risk is low.
DNSSEC signed
11% observed · all sites 8%
Enable DNSSEC at your DNS provider, then add the DS record at your registrar. Plan provider moves carefully: a stale DS record can make the domain fail to resolve.
Guide: Website Uptime Readiness: Prepare Before Traffic Arrives
Certificate lifetime of 100 days or less
21% observed · all sites 67%
Move to automated issuance and renewal now, while you still have time to test it.
Where Adobe Experience Manager sites lead
- HSTS kept for at least a year79% observedall sites 34%
- X-Content-Type-Options: nosniff86% observedall sites 48%
- Framing restricted87% observedall sites 51%
- DMARC policy enforces quarantine or reject74% observedall sites 39%