experienceleague.adobe.com Open in urlscan Pro
52.167.10.121 Public Scan

Back to summary

URL:
https://experienceleague.adobe.com/docs/experience-manager-64/administering/security/security-checklist.html?lang=en
Submission: On February 22 via manual (February 22nd 2023, 10:53:44 am UTC) from GB — Scanned from GB

Form analysis
1 forms found in the DOM

<form>
  <div class="control has-icons-left has-icons-right">
    <input class="input" type="search" placeholder="Search Experience League">
    <span class="icon is-small is-left">
      <img src="/assets/img/search_grey.svg" loading="lazy" alt="Search">
    </span>
  </div>
</form>

Text Content

Experience League
Sign In

Learn
Courses Recommended courses Tutorials Events Instructor-led training Browse
content library View all learning options
Documentation
Community
Quick links

--------------------------------------------------------------------------------

Experience Cloud Advocates
Meet our community of customer advocates
Events
Attend local and virtual events
Employee Advisors
Connect with one of our experts
Experience League Showcase
Read real-world use cases of Experience Cloud products written by your peers
Communities by product

--------------------------------------------------------------------------------

Community home Advertising Cloud Analytics Audience Manager Campaign Classic v7
& Campaign v8 Campaign Standard Developer Cloud Extensibility Experience Cloud
Experience Manager Sites & More Experience Platform Journey Optimizer Target
Real-Time Customer Data Platform Workfront Creative Cloud Document Cloud
Commerce Marketo Engage

Support
Sign In
Deutsch English Español Français Italiano Nederlands Português Svenska 中文 (简体)
中文 (繁體) 日本語 한국어
Adobe Experience Cloud Adobe Document Cloud
Profile Profile Achievements
View your awards after completing your profile.
Bookmarks
View your bookmarks after completing your profile.
Sign out

Learn

Courses
Recommended courses
Tutorials
Events
Instructor-led training
Browse content library
View all learning options
Search Results
Documentation
Community

Communities by product

Community home
Advertising Cloud
Analytics
Audience Manager
Campaign Classic v7 & Campaign v8
Campaign Standard
Developer Cloud Extensibility
Experience Cloud
Experience Manager Sites & More
Experience Platform
Journey Optimizer
Target
Real-Time Customer Data Platform
Workfront
Creative Cloud
Document Cloud
Commerce
Marketo Engage
Quick links

Experience Cloud Advocates
Events
Employee Advisors
Experience League Showcase
Support

Home Opening a case requires entitlement. Open Ticket Opening a case requires
entitlement. My Cases
Profile Profile Achievements
View your awards after completing your profile.
Bookmarks
View your bookmarks after completing your profile.
Adobe Experience Cloud Adobe Document Cloud Search

--------------------------------------------------------------------------------

Sign Out
Change language

Deutsch
English
Español
Français
Italiano
Nederlands
Português
Svenska
中文 (简体)
中文 (繁體)
日本語
한국어
Adobe Experience League
Clear

SearchLoading
Exit search


Experience League
Exit search
 * Administering User Guide overview
 * Sites Features
   * Website Administration
   * Reusing Content: Multi Site Manager and Live Copy
   * Live Copy Overview Console
   * Configuring Live Copy Synchronization
   * Creating and Synchronizing Live Copies
   * MSM Rollout Conflicts
   * MSM Best Practices
   * Translating Content for Multilingual Sites
   * Managing Translation Projects
   * Identifying Content to Translate
   * Preparing Content for Translation
   * Creating a Language Root Using the Classic UI
   * Connecting to Microsoft Translator
   * Configuring the Translation Integration Framework
   * Language Copy Wizard
   * Translation Enhancements
   * Translation Best Practices
   * Configurations and the Configuration Browser
   * AEM FAQs
 * Operations
   * Dashboards
   * Operations Dashboard
   * Backup and Restore
   * Data Store Garbage Collection
   * Monitoring Server Resources Using the JMX Console
   * Working with Logs
   * Configure the Rich Text Editor
   * Configure the Video component
   * The Bulk Editor
   * Configuring Email Notification
   * Configuring RTE for Producing Accessible Sites
   * The Link Checker
   * Troubleshooting AEM
   * Audit Log Maintenance in AEM 6
   * Editor
   * Managing Access to Workflows
   * Using cURL with AEM
   * Configuring Undo for Page Editing
   * Proxy Server Tool (proxy.jar)
   * Configuring for AEM Apps
   * Administering Workflows
   * Configuring Search Forms
   * Tools Consoles
   * Reporting
   * Administering Workflow Instances
   * Configuring Layout Container and Layout Mode
   * Enabling Access to Classic UI
   * Starting Workflows
   * Configure the Rich Text Editor plug-ins
   * Admin Consoles
 * Security
   * User Administration and Security
   * User, Group and Access Rights Administration
   * Security Checklist
   * OWASP Top 10
   * Running AEM in Production Ready Mode
   * Identity Management
   * Adobe IMS Authentication and Admin Console Support for AEM Managed Services
   * Creating a Closed User Group
   * Mitigating serialization issues in AEM
   * User Synchronization
   * Encapsulated Token Support
   * Single Sign On
   * How to Audit User Management Operations in AEM
   * SSL By Default
   * SAML 2.0 Authentication Handler
   * Closed User Groups in AEM
   * Granite Operations - User and Group Administration
   * Enabling CRXDE Lite in AEM
   * Configuring LDAP with AEM 6
   * Configure the Admin Password on Installation
   * Service Users in AEM
   * Encryption Support for Configuration Properties
   * Handling GDPR Requests for the AEM Foundation
   * Content Disposition Filter
 * Personalization
   * Personalization
   * Configuring ContextHub
   * Client Context
   * Campaigns
   * Configuring Segmentation with ContextHub
   * Configuring Segmentation
   * Extending and Configuring the Design Importer for Landing Pages
   * Integrating Landing Pages with Adobe Analytics
 * eCommerce
   * eCommerce
   * Concepts
   * Administering Generic eCommerce
   * Magento
   * SAP Commerce Cloud
   * Salesforce Commerce Cloud
   * AEM Commerce - GDPR Readiness
 * Integration
   * Integrating with Third-Party Services
   * Integrating with Salesforce
   * Integrating with Adobe Target
   * Integrating with Livefyre
   * Integrating with Adobe Analytics
   * Connecting to Adobe Analytics and Creating Frameworks
   * Configuring Link Tracking for Adobe Analytics
   * Mapping Component Data with Adobe Analytics Properties
   * Configuring Video Tracking for Adobe Analytics
   * HTTP2 Delivery of Content FAQ
   * Troubleshooting your Adobe Campaign Integration
   * SharePoint Connector Licenses, Copyright Notices, and Disclaimers
   * SharePoint Connector
   * DHTML Viewer End-of-Life FAQs
   * Integrating with Adobe Campaign Classic
   * Related Community Articles
   * Integrating with Adobe Campaign Standard
   * Flash Viewers End-of-Life Notice
   * Integrating with Adobe Creative Cloud
   * Integrating with Adobe Dynamic Tag Management
   * Opting Into Adobe Analytics and Adobe Target
   * AEM Portals and Portlets
   * Integrating with Dynamic Media Classic
   * AEM Livefyre Recipes
   * Troubleshooting Integration Issues
   * Integrating with BrightEdge Content Optimizer
   * Best Practices for Email Templates
   * Catalog Producer
   * Integrating with Silverpop Engage
   * Integrating with Adobe Campaign
   * Integrating with ExactTarget
   * Analytics with External Providers
   * Integrating with the Adobe Marketing Cloud
   * Manually Configuring the Integration with Adobe Target
   * Prerequisites for Integrating with Adobe Target
   * Adobe Classifications
   * Solutions Integration
   * Target Integration with Experience Fragments
 * Best Practices
   * Best Practices
   * Translation Best Practices
   * MSM Best Practices
   * AEM Sites - GDPR Readiness
   * Handling GDPR Requests for the AEM Foundation
   * AEM Commerce - GDPR Readiness
 * Content Management
   * How to Work With Packages
   * Assets Workflow Offloader
   * Administering Tags
   * The Page Exporter
   * Classic UI Tagging Console
   * Content Management for Screens
   * WebDAV Access

Documentation AEM 6.4 Administering Guide Security Checklist


SECURITY CHECKLIST

This section deals with various steps that you should take to ensure that your
AEM installation is secure when deployed. The checklist is meant to be applied
from top to bottom.

NOTE

Further information is also available about the most dangerous security threats
as published by Open Web Application Security Project (OWASP).

NOTE

There are some additional security considerations applicable at the development
phase.


MAIN SECURITY MEASURES


RUN AEM IN PRODUCTION READY MODE

For more information, see Running AEM in Production Ready Mode.


ENABLE HTTPS FOR TRANSPORT LAYER SECURITY

Enabling the HTTPS transport layer on both author and publish instances is
mandatory for having a secure instance.

NOTE

See the Enabling HTTP Over SSL section for more information.


INSTALL SECURITY HOTFIXES

Ensure that you have installed the latest Security Hotfixes provided by Adobe.


CHANGE DEFAULT PASSWORDS FOR THE AEM AND OSGI CONSOLE ADMIN ACCOUNTS

Adobe strongly recommends that after installation you change the password for
the privileged AEM admin accounts (on all instances).

These accounts include:

 * The AEM admin account
   
   Once you have changed the password for the AEM admin account, you will need
   to use the new password when accessing CRX.

 * The admin password for the OSGi Web console
   
   This change will also be applied to the admin account used for accessing the
   Web console, so you will need to use the same password when accessing that.

These two accounts use separate credentials and having distinct, strong password
for each is vital to a secure deployment.

CHANGING THE AEM ADMIN PASSWORD

The password for the AEM admin account can be changed via the Granite Operations
- Users console.

Here you can edit the admin account and change the password.

NOTE

Changing the admin account also changes the OSGi web console account. After
changing the admin account, you should then change the OSGi account to something
different.

IMPORTANCE OF CHANGING THE OSGI WEB CONSOLE PASSWORD

Aside from the AEM admin account, failing to change the default password for the
OSGi web console password can lead to:

 * Exposure of the server with a default password during startup and shutdown
   (that can take minutes for large servers);
 * Exposure of the server when the repository is down/restarting bundle - and
   OSGI is running.

For more information on changing the web console password, see Changing the OSGi
web console admin password below.

CHANGING THE OSGI WEB CONSOLE ADMIN PASSWORD

You must also change the password used for accessing the Web console. This is
done by configuring the following properties of the Apache Felix OSGi Management
Console:

User Name and Password, the credentials for accessing the Apache Felix Web
Management Console itself.
The password must be changed after the initial installation to ensure the
security of your instance.

To do this:

 1. Navigate to the web console at <server>:<port>/system/console/configMgr.

 2. Navigate to** Apache Felix OSGi Management Console** and change the user
    name and password.
    
    

 3. Click Save.


IMPLEMENT CUSTOM ERROR HANDLER

Adobe recommends to define custom error handler pages, especially for 404 and
500 HTTP Response codes in order to prevent information disclosure.

NOTE

See How can I create custom scripts or error handlers knowledge base article for
more details.


COMPLETE DISPATCHER SECURITY CHECKLIST

AEM Dispatcher is a critical piece of your infrastructure. Adobe strongly
recommend that you complete the dispatcher security checklist.

CAUTION

Using the Dispatcher you must disable the “.form” selector.


VERIFICATION STEPS


CONFIGURE REPLICATION AND TRANSPORT USERS

A standard installation of AEM specifies admin as the user for transport
credentials within the default replication agents. Also, the admin user is used
to source the replication on the author system.

For security considerations, both should be changed to reflect the particular
use case at hand, with the following two aspects in mind:

 * The transport user should not be the admin user. Rather, set up a user on the
   publish system that has only access rights to the relevant portions of the
   publish system and use that user’s credentials for the transport.
   
   You can start from the bundled replication-receiver user and configure this
   user’s access rights to match your situation

 * The replication user or Agent User Id should also not be the admin user, but
   a user who can only see content that is supposed to be replicated. The
   replication user is used to collect the content to be replicated on the
   author system before it is sent to the publisher.


CHECK THE OPERATIONS DASHBOARD SECURITY HEALTH CHECKS

AEM 6 introduces the new Operations Dashboard, aimed at aiding system operators
troubleshoot problems and monitor the health of an instance.

The dashboard also comes with a collection of security health checks. It is
recommended you check the status of all the security health checks before going
live with your production instance. For more information, consult the Operations
Dashboard documentation.


CHECK IF EXAMPLE CONTENT IS PRESENT

All example content and users (e.g. the Geometrixx project and its components)
should be uninstalled and deleted completely on a productive system before
making it publicly accessible.

NOTE

The sample We.Retail applications are removed if this instance is running in
Production Ready Mode. If, for any reason, this is not the case, you can
uninstall the sample content by going to Package Manager, then serarching for
and uninstalling all We.Retail packages. Fore more info, see How to Work With
Packages.


CHECK IF THE CRX DEVELOPMENT BUNDLES ARE PRESENT

These development OSGi bundles should be uninstalled on both author and publish
productive systems before making them accessible.

 * Adobe CRXDE Support (com.adobe.granite.crxde-support)
 * Adobe Granite CRX Explorer (com.adobe.granite.crx-explorer)
 * Adobe Granite CRXDE Lite (com.adobe.granite.crxde-lite)


CHECK IF THE SLING DEVELOPMENT BUNDLE IS PRESENT

The AEM Developer Tools for Eclipse deployes the Apache Sling Tooling Support
Install (org.apache.sling.tooling.support.install).

This OSGi bundle should be uninstalled on both author and publish productive
systems before making them accessible.


PROTECT AGAINST CROSS-SITE REQUEST FORGERY

THE CSRF PROTECTION FRAMEWORK

AEM 6.1 ships with a mechanism that helps protect agains Cross-Site Request
Forgery attacks, called the CSRF Protection Framework. For more information on
how to use it, consult the documentation.

THE SLING REFERRER FILTER

To address known security issues with Cross-Site Request Forgery (CSRF) in CRX
WebDAV and Apache Sling you need to add configurations for the Referrer filter
in order to use it.

The referrer filter service is an OSGi service that allows you to configure:

 * which http methods should be filtered

 * whether an empty referrer header is allowed

 * and a list of servers to be allowed in addition to the server host.
   
   By default, all variations of localhost and the current host names the server
   is bound to are in the list.

To configure the referrer filter service:

 1. Open the Apache Felix console (Configurations) at:
    
    https://<server>:<port_number>/system/console/configMgr

 2. Login as admin.

 3. In the Configurations menu, select:
    
    Apache Sling Referrer Filter

 4. In the Allow Hosts field, enter all hosts that are allowed as a referrer.
    Each entry needs to be of the form
    
    <protocol>://<server>:<port>
    
    For example:
    
    * https://allowed.server:80 allows all requests from this server with the
      given port.
    * If you also want to allow https requests, you have to enter a second line.
    * If you allow all ports from that server you can use 0 as the port number.

 5. Check the Allow Empty field, if you want to allow empty/missing referrer
    headers.
    
    CAUTION
    
    It is recommended to provide a referrer while using commandline tools such
    as cURL instead of allowing an empty value as it might expose your system to
    CSRF attacks.

 6. Edit the methods this filter should use for checks with the Filter Methods
    field.

 7. Click Save to save your changes.


OSGI SETTINGS

Some OSGI settings are set by default to allow easier debugging of the
application. These need to be changed on your publish and author productive
instances to avoid internal information leaking to the public.

NOTE

All of the below settings with the exception of The Day CQ WCM Debug Filter are
automatically covered by the Production Ready Mode. Because of this, we
recommend reviewing all the settings before deploying your instance in a
productive environment.

For each of the following services the specified settings need to be changed:

 * Adobe Granite HTML Library Manager:
   
   * enable Minify (to remove CRLF and whitespace characters).
   * enable Gzip (to allow files to be gzipped and accessed with one request).
   * disable Debug
   * disable Timing

 * Day CQ WCM Debug Filter:
   
   * uncheck Enable

 * Day CQ WCM Filter:
   
   * on publish only, set WCM Mode to “disabled”

 * Apache Sling Java Script Handler:
   
   * disable Generate Debug Info

 * Apache Sling JSP Script Handler:
   
   * disable Generate Debug Info
   * disable Mapped Content

For further details see OSGi Configuration Settings.

When working with AEM there are several methods of managing the configuration
settings for such services; see Configuring OSGi for more details and the
recommended practices.


FURTHER READINGS


MITIGATE DENIAL OF SERVICE (DOS) ATTACKS

A denial of service (DoS) attack is an attempt to make a computer resource
unavailable to its intended users. This is often done by overloading the
resource; for example:

 * With a flood of requests from an external source.

 * With a request for more information than the system can successfully deliver.
   
   For example, a JSON representation of the entire repository.

 * By requesting a content page with an unlimited number of URLs, The URL can
   include a handle, some selectors, an extension, and a suffix - any of which
   can be modified.
   
   For example, .../en.html can also be requested as:
   
   * .../en.ExtensionDosAttack
   * .../en.SelectorDosAttack.html
   * .../en.html/SuffixDosAttack
   
   All valid variations (e.g. return a 200 response and are configured to be
   cached) will be cached by the dispatcher, eventually leading to a full file
   system and no service for further requests.

There are many points of configuration for preventing such attacks, here we only
discuss those directly related to AEM.

Configuring Sling to Prevent DoS

Sling is content-centric. This means that processing is focused on the content
as each (HTTP) request is mapped onto content in the form of a JCR resource (a
repository node):

 * The first target is the resource (JCR node) holding the content.
 * Secondly, the renderer, or script, is located from the resource properties in
   combination with certain parts of the request (e.g. selectors and/or the
   extension).

NOTE

This is covered in more detail under Sling Request Processing.

This approach makes Sling very powerful and very flexible, but as always it is
the flexibility that needs to be carefully managed.

To help prevent DoS misuse you can:

 1. Incorporate controls at the application level; due to the number of
    variations possible a default configuration is not feasible.
    
    In your application you should:
    
    * Control the selectors in your application, so that you only serve the
      explicit selectors needed and return 404 for all others.
    * Prevent the output of an unlimited number of content nodes.

 2. Check the configuration of the default renderers, which can be a problem
    area.
    
    * In particular the JSON renderer which can transverse the tree structure
      over multiple levels.
      
      For example, the request:
      
      http://localhost:4502/.json
      
      could dump the whole repository in a JSON representation. This would cause
      significant server problems. For this reason Sling sets a limit on the
      number of maximum results. To limit the depth of the JSON rendering you
      can set the value for:
      
      JSON Max results ( json.maximumresults)
      
      in the configuration for the Apache Sling GET Servlet. When this limit is
      exceeded the rendering will be collapsed. The default value for Sling
      within AEM is 1000.
    
    * As a preventive measure disable the other default renderers (HTML, plain
      text, XML). Again by configuring the Apache Sling GET Servlet.
    CAUTION
    
    Do not disable the JSON renderer, this is required for the normal operation
    of AEM.

 3. Use a firewall to filter access to your instance.
    
    * The use of an operating system level firewall is necessary in order to
      filter access to points of your instance that might lead to denial of
      service attacks if left unprotected.

Mitigate Against DoS Caused by Using Form Selectors

NOTE

This mitigation should be performed only on AEM environments that are not using
Forms.

Since AEM does not provide out of the box indexes for the FormChooserServlet,
using form selectors in queries will trigger a costly repository traversal,
usually grinding the AEM instance to a halt. Form selectors can be detected by
the presence of the *.form.* string in queries.

In order to mitigate this, please follow the below steps:

 1. Go to the Web Console by pointing your browser to
    https://<serveraddress>:<serverport>/system/console/configMgr

 2. Search for Day CQ WCM Form Chooser Servlet

 3. After you click on the entry, disable the Advanced Search Require in the
    following window.

 4. Click Save.

Mitigate Against DoS Caused by Asset Download Servlet

The default Asset Download Servlet in AEM allows authenticated users to issue
arbitrarily-large, concurrent download requests for creating ZIP files of assets
visible to them that can overload the server and/or network.

To mitigate potential DoS risks caused by this feature, AssetDownloadServlet
OSGi component is disabled by default for publish instances on latest AEM
versions.

If your setup requires that the Asset Download Server be enabled, please see
this article for more information.


DISABLE WEBDAV

WebDAV should be disabled on both the author and publish environments. This can
be done by stopping the appropriate OSGi bundles.

 1. Connect to the Felix Management Console running on:
    
    https://<*host*>:<*port*>/system/console
    
    For example http://localhost:4503/system/console/bundles.

 2. In the list of bundles, find the bundle named:
    
    Apache Sling Simple WebDAV Access to repositories
    (org.apache.sling.jcr.webdav)

 3. Click the stop button (in the Actions column) to stop this bundle.

 4. Again in the list of bundles, find the bundle named:
    
    Apache Sling DavEx Access to repositories (org.apache.sling.jcr.davex)

 5. Click the stop button to stop this bundle.
    
    NOTE
    
    A restart of AEM is not required.


VERIFY THAT YOU ARE NOT DISCLOSING PERSONALLY IDENTIFIABLE INFORMATION IN THE
USERS HOME PATH

It is important you protect your users by making sure that you do not expose any
personally indetifiable information in the repository users home path.

Since AEM 6.1, the way user (also known as authorizable) ID node names are
stored is changed with a new implementation of the AuthorizableNodeName
interface. The new interface will no longer expose the user ID in the node name,
but will generate a random name instead.

No configuration needs to be performed in order to enable it, as this is now the
default way of generating authorizable IDs in AEM.

Although not recommended, you can disable it in case you need the old
implementation for backwards compatibility with your exsiting applications. In
order to do this, you need to:

 1. Go to the Web Console and remove the**
    org.apache.jackrabbit.oak.security.user.RandomAuthorizableNodeName** entry
    from property requiredServicePids in Apache Jackrabbit Oak SecurityProvider.
    
    You can also find the Oak Security Provider by looking for the
    org.apache.jackrabbit.oak.security.internal.SecurityProviderRegistration PID
    in the OSGi configurations.

 2. Delete the Apache Jackrabbit Oak Random Authorizable Node Name OSGi
    configuration from the Web Console.
    
    For easier lookup, note that the PID for this configuration is
    org.apache.jackrabbit.oak.security.user.RandomAuthorizableNodeName.

NOTE

For more information, see the Oak documentation on Authorizable Node Name
Generation.


PREVENT CLICKJACKING

To prevent clickjacking we recommend that you configure your webserver to
provide the X-FRAME-OPTIONS HTTP header set to SAMEORIGIN.

For more information on clickjacking please see the OWASP site.


MAKE SURE YOU PROPERLY REPLICATE ENCRYPTION KEYS WHEN NEEDED

Certain AEM features and authentication schemes require that you replicate your
encryption keys across all AEM instances.

Before you do this, please take note that key replication is done differently
between versions because the way in which keys are stored is different between
6.3 and older versions.

See below for more information.

REPLICATING KEYS FOR AEM 6.3

Whereas in older versions the replication keys were stored in the repository,
beginning with AEM 6.3 they are stored on the filesystem.

Therefore, in order to replicate your keys across instances you need to copy
them from the source instance to the target instances’ location on the
filesystem.

More specifically, you need to:

 1. Access the AEM instance, typically an author instance, that contains the key
    material to copy;

 2. Locate the com.adobe.granite.crypto.file bundle in the local file system.
    For example, under this path:
    
    * <author-aem-install-dir>/crx-quickstart/launchpad/felix/bundle21
    
    The bundle.info file inside each folder will identify the bundle name.

 3. Navigate to the data folder. For example:
    
    * <author-aem-install-dir>/crx-quickstart/launchpad/felix/bundle21/data

 4. Copy the HMAC and master files.

 5. Then, go to the target instance you want to duplicate the HMAC key to, and
    navigate to the data folder. For example:
    
    * <publish-aem-install-dir>/crx-quickstart/launchpad/felix/bundle21/data

 6. Paste the two files you previously copied.

 7. Refresh the Crypto Bundle if the target instance is already running.

 8. Repeat the above steps for all instances you want to replicate the key to.

NOTE

You can revert to the pre 6.3 method of storing keys by adding the below
parameter when you first install AEM:

-Dcom.adobe.granite.crypto.file.disable=true

REPLICATING KEYS FOR AEM 6.2 AND OLDER VERSIONS

In AEM 6.2 and older versions, the keys are stored in the repository under the
/etc/key node.

The recommended way to securely replicate the keys across your instances is to
only replicate this node. You can selectively replicate nodes via CRXDE Lite:

 1. Open CRXDE Lite by going to https://<serrveraddress>:4502/crx/de/index.jsp
 2. Select the /etc/key node.
 3. Go to the Replication tab.
 4. Press the Replication button.


PERFORM A PENETRATION TEST

Adobe strongly recommends to perform a penetration test of your AEM
infrastructure before going on production.


DEVELOPMENT BEST PRACTICES

It is critical that new development are following the Security Best Practices to
ensure your AEM environement stays safe.


MORE HELP ON THIS FEATURE

 * User Administration and Security
 * Service Users in AEM

BUSINESS.ADOBE.COM RESOURCES

Auto Text Summarization Auto Form Fill Targeted Content Personalized Experiences
Managed Cloud Version History
Bookmark page Remove bookmark
Sign-in to bookmark
Bookmark
Copy link URL
Copy link


ON THIS PAGE

 * Main Security Measures
 * Run AEM in Production Ready Mode
 * Enable HTTPS for transport layer security
 * Install Security Hotfixes
 * Change Default Passwords For the AEM and OSGi Console Admin Accounts
 * Implement Custom Error Handler
 * Complete Dispatcher Security Checklist
 * Verification Steps
 * Configure replication and transport users
 * Check the Operations Dashboard Security Health Checks
 * Check if Example Content is Present
 * Check if the CRX development bundles are present
 * Check if the Sling development bundle is present
 * Protect against Cross-Site Request Forgery
 * OSGI Settings
 * Further Readings
 * Mitigate Denial of Service (DoS) Attacks
 * Disable WebDAV
 * Verify That You Are Not Disclosing Personally Identifiable Information In the
   Users Home Path
 * Prevent Clickjacking
 * Make Sure You Properly Replicate Encryption Keys When Needed
 * Perform a Penetration Test
 * Development Best Practices


VIEW NEXT:




Register now




GET YOUR AEM SITES CONTENT AUTHOR CREDENTIAL TODAY!

The Adobe Digital Learning Services Qualified Credential Program is designed to
credential AEM Sites business users who author and manage web pages in their
organization’s instance. Visit Adobe Digital Learning Services to see how to get
your credential today!

Sign up




ACCELERATING EXPERIENCE MANAGER AS A CLOUD SERVICE DEVELOPMENT WITH RAPID
DEVELOPMENT ENVIRONMENTS


WEDNESDAY, FEB 22ND | 5:00PM CET | 8:00AM PT

Adobe has introduced Rapid Development Environments. RDEs allow developers to
swiftly deploy and review changes, minimizing the amount of time needed to test
features that are proven to work in a local development environment

Register
Last Updated: September 28, 2021
Was this content helpful?
Thumbs UpThumbs Down


WAS THIS CONTENT HELPFUL?

Error loading. Refresh page.
Error loading. Refresh page.
Content is helpful
Content is not helpful


THANK YOU FOR YOUR FEEDBACK.

Refresh your page to provide more feedback. Please take a moment to explain your
selection or how we could improve.
Submit
Provide feedback to submit
Submit feedback
Dismiss
Detailed feedback options
Other feedback options
Report an issue
Open GitHub to report
This feature is unavailable on this page
Suggest an edit
Open GitHub to edit
This feature is unavailable on this page
Learn how to contribute.
Learn

Courses
Recommended courses
Tutorials
Instructor-led training
Browse content library
All Learning
Search Results
Documentation

Documentation home
Experience Cloud release notes
Document Cloud release notes
Community

Community home
Advertising Cloud
Analytics
Audience Manager
Campaign Standard
Experience Cloud
Experience Manager
Experience Platform
Commerce
Marketo Engage
Target
Workfront
Feedback Panel
Support

Experience Cloud support
Document Cloud support
Community forums
Resources

Adobe Developer
Adobe status
Adobe Account

Log in to your account
Adobe

About
Careers
Newsroom
Corporate responsibility
Investor Relations
Supply chain
Trust Center
Events
Diversity & Inclusion
Integrity
COVID-19 Responses


LEARN

 * Courses
 * Recommended courses
 * Tutorials
 * Instructor-led training
 * Browse content library
 * View all learning options

DOCUMENTATION

 * Documentation home
 * Experience Cloud release notes
 * Document Cloud release notes

COMMUNITY

 * Community home
 * Advertising Cloud
 * Analytics
 * Audience Manager
 * Campaign Standard
 * Commerce
 * Experience Cloud
 * Experience Manager
 * Experience Platform
 * Marketo Engage
 * Target
 * Workfront
 * Feedback Panel

SUPPORT

 * Experience Cloud support
 * Document Cloud support
 * Community forums

RESOURCES

 * Adobe Developer
 * Adobe status

ADOBE ACCOUNT

 * Log in to your account

ADOBE

 * About
 * Careers
 * Newsroom
 * Corporate responsibility
 * Investor Relations
 * Supply chain
 * Trust Center
 * Events
 * Diversity & Inclusion
 * Integrity
 * COVID-19 Responses

Change language
Deutsch English Español Français Italiano Nederlands Português Svenska 中文 (简体)
中文 (繁體) 日本語 한국어

Copyright © 2023 Adobe. All Rights Reserved.
Privacy
Terms of Use
Cookie preferences
Do not sell my personal information
AdChoices




MAKE IT YOUR OWN

Adobe and its vendors use cookies and similar technologies to improve your
experience and measure your interactions with our websites, products and
services. We also use them to provide you more relevant information in searches
and in ads on this and other sites. If that’s okay, click “Enable all". Clicking
“Don’t enable” will set only cookies that are strictly necessary. You can also
view our vendors and customize your choices by clicking "Cookie Settings".

Cookie Settings Don't Enable Enable all




COOKIE SETTINGS

Don’t enable Enable all Confirm my choices


GENERAL INFORMATION

 * You are in control of your data.
   
   You can control how Adobe websites use cookies and similar technologies by
   making choices below. But note that if you disable cookies and similar
   technologies entirely, Adobe websites may not function properly.

 * What are cookies and why does Adobe use them?
   
   Cookies are small text files stored by your web browser when you use
   websites. There are also other technologies that can be used for similar
   purposes like HTML5 Local Storage and local shared objects, web beacons, and
   embedded scripts. These technologies help us do things like remembering you
   and your preferences when you return to our sites, measure how you use the
   website, conduct market research, and gather information about the ads you
   see and interact with.

 * How do I make choices?
   
   You can make choices in the menu below about what cookies and other
   technologies you want us to use on Adobe sites when you visit them from this
   browser. You can always change those choices later by clicking on the Cookie
   Preferences link at the bottom of the page.




IF ENABLED:

 * We can improve your experience by tailoring the site and the content to
   things we think might be of interest
 * We can better keep track of your preferences — like what language you prefer
   to use
 * We will better understand your likely interests so we can provide you more
   relevant Adobe ads and content on non-Adobe websites and in non-Adobe apps
 * It will help us improve the performance of our website and those of our
   partners who use the Adobe Experience Cloud


IF DISABLED:

 * We won’t be able to remember you from session to session so the experience
   may not be tailored to your interests
 * You’ll still have access to the content of the site but certain features that
   depend on cookies may not function
 * You’ll still see ads, they just may not be as relevant to you


Enable all

OPERATE THE SITE AND CORE SERVICES

Always active
Operate the site and core services



These cookies are required, and they are used to enable the site and related
services core functionality. Without them the site could not operate, so they
cannot be disabled.



Cookie details‎

MEASURE PERFORMANCE

Measure performance



These cookies are used to analyze site usage to measure and improve performance.
Without them Adobe cannot know what content is most valued and how often unique
visitors return to the site, making it hard to improve information we offer to
you.



Cookie details‎

EXTEND FUNCTIONALITY

Extend functionality



These cookies are used to enhance the functionality of Adobe sites such as
remembering your settings and preferences to deliver a personalized experience;
for example, your username, your repeated visits, preferred language, your
country, or any other saved preference.



Cookie details‎

PERSONALIZE ADVERTISING

Personalize advertising



These cookies are used to enable Adobe and our partners to serve ads more
relevant to your interests. Without them you will still see ads, but they might
not be as relevant to you.



Cookie details‎
Confirm my choices

Back Button

Back


PERFORMANCE COOKIES



Vendor Search Search Icon Filter Icon


Clear Filters

Information storage and access
Apply
Consent Leg.Interest

All Consent Allowed

Select All Vendors
Select All Vendors
All Consent Allowed

 * HOST DESCRIPTION
   
   View Cookies
   
   REPLACE-WITH-DYANMIC-HOST-ID
    * Name
      cookie name

Confirm my choices


x

experienceleague.adobe.com Open in urlscan Pro 52.167.10.121 Public Scan

Form analysis 1 forms found in the DOM

Text Content

experienceleague.adobe.com Open in urlscan Pro
52.167.10.121 Public Scan

Form analysis
1 forms found in the DOM