Missing or misconfigured security headers in Adobe Experience Manager

Last update: August 18, 2026

In Adobe Experience Manager (AEM), security scans can report missing or insecure HTTP response headers, including HSTS, CSP, X-Frame-Options, X-Content-Type-Options, or exposed Server headers. The issue usually comes from the layer serving the response, such as the Dispatcher, CDN, or Dynamic Media delivery domain, or from scanners that do not interpret redirects correctly. To fix this, validate the full response chain with curl and confirm the required headers appear on the live domain.

Description description

Environment

Adobe Experience Manager as a Cloud Service
AEM Managed Services
AEM Dynamic Media

Issue/Symptoms

Security scans report a missing Strict-Transport-Security header.
Security scans report missing Content-Security-Policy, X-Content-Type-Options, or X-Frame-Options headers.
Security scans report an exposed or insecure Server header on Dynamic Media domains.
Security tools flag insecure redirect behavior because HSTS is not detected on HTTP-to-HTTPS redirects.
HSTS preload validation fails because the CDN response does not include the required Strict-Transport-Security header.

Cause

Required headers may be missing because Dispatcher configuration does not set them, CDN response transformation rules are not configured, or Dynamic Media delivery domains still require Adobe-side header enablement. Some findings can also be false positives when scanners do not follow redirects correctly or when an initial HTTP request is blocked before the final HTTPS response is evaluated.

Resolution resolution

To address missing or incorrect security headers, follow these steps:

Determine which layer is responsible for the response: AEM as a Cloud Service CDN, AEM Managed Services Dispatcher, or Dynamic Media delivery.

Note: If the issue affects a Dynamic Media delivery domain, contact Adobe Support and request the required header changes for the affected domain.
Update the CDN response transformation rules to add or adjust the required headers, and deploy the changes if the issue affects an AEM as a Cloud Service custom domain.
Update the Dispatcher vhost configuration to set the required headers if the issue affects an AEM Managed Services domain.
For Managed Services environments, configured response headers include values such as:

Header always set Strict-Transport-Security "max-age=63072000; includeSubDomains; preload"
Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "DENY"
Header always set Content-Security-Policy "upgrade-insecure-requests"

Validate the live response after the change and review the full redirect chain when the finding involves HTTP-to-HTTPS behavior.

curl -Is https://domain.com | grep -i strict-transport-security
curl -Is https://domain.com | grep -i server
curl -v -L http://domain

Confirm that the required headers appear on the final HTTPS response and that any reported redirect issue is not caused by scanner interpretation of the initial HTTP response.
Re-run the security scan or penetration test to confirm the finding is resolved.

recommendation-more-help

experience-cloud-kcs-help-kbarticles