Stack playbook · Snapshot 23 October 2026
Sitecore on Azure Front Door/CDN: readiness playbook
What 159 measured sites on this stack get right, where they fall short, and the Sitecore on Azure Front Door/CDN-specific steps that close each gap.
- Sites measured
- 159
- Median readiness index
- 70/100
- Profiles on this stack
- 18
detected from homepage HTML and headers
all sites: 64
top-50K sites
Readiness by lane
Enable
90/100
All sites 77
Harden
68/100
All sites 55
Accelerate
58/100
All sites 63
Recover
19/100
All sites 11
The Sitecore on Azure Front Door/CDN playbook
Gaps ordered by impact, with the platform-specific step where one exists.
Modern image formats in use
26% observed · all sites 40%
Serve WebP or AVIF with a JPEG or PNG fallback, either through an image CDN or by generating both formats at build time.
Guide: AVIF, WebP, JPEG, and PNG: Choose the Right Image Format
HTTP/3 advertised
1.9% observed · all sites 36%
Turn on HTTP/3 at your CDN. Browsers fall back to HTTP/2 automatically, so the risk is low.
security.txt published
16% observed · all sites 5.5%
Publish /.well-known/security.txt with at least Contact and Expires fields, as RFC 9116 requires, and review it before it expires.
Static files cached for 30 days or more
44% observed · all sites 50%
Give versioned (fingerprinted) CSS, JavaScript, fonts and images Cache-Control: public, max-age=31536000, immutable, and change the file name whenever the content changes.
CAA records limit who can issue certificates
17% observed · all sites 11%
Publish CAA records naming every CA you actually use, including the CAs your CDN uses for managed certificates. Add an iodef contact if you want reports.
No render-blocking scripts in <head>
41% observed · all sites 44%
Add defer to scripts that need the DOM, async to independent ones such as analytics, or move them to the end of the body.
Guide: Control Third-Party Scripts Before They Control Your Page
Certificate lifetime of 100 days or less
8.3% observed · all sites 75%
Move to automated issuance and renewal now, while you still have time to test it.
DNSSEC signed
11% observed · all sites 8.1%
Enable DNSSEC at your DNS provider, then add the DS record at your registrar. Plan provider moves carefully: a stale DS record can make the domain fail to resolve.
Guide: Website Uptime Readiness: Prepare Before Traffic Arrives
Where Sitecore on Azure Front Door/CDN sites lead
- Reachable over IPv691% observedall sites 44%
- HSTS kept for at least a year75% observedall sites 31%
- DMARC policy enforces quarantine or reject72% observedall sites 31%
- Content Security Policy present59% observedall sites 31%