--- title: Transport Layer Security slug: web-experimentation/docs/transport-layer-security docTags: createdAt: 2026-07-23T11:40:26.754Z --- Optimizely Web Experimentation and Optimizely Personalization use Transport Layer Security (TLS) for 100% of content delivery network (CDN) traffic to protect against [Man In The Middle](https://en.wikipedia.org/wiki/Man-in-the-middle_attack) attacks and meet customer compliance requirements. Optimizely works to minimize the impact of TLS on both CPU and performance. Optimizely TLS encryption is highly secure, [maintaining an A grade from SSLLabs](https://www.ssllabs.com/ssltest/analyze.html?d=cdn.optimizely.com\&latest). ## HSTS Optimizely's CDN `cdn.optimizely.com` sends the HSTS header. This header informs clients to connect to `cdn.optimizely.com` over HTTPS regardless of whether it is using the `http://` or `https://` URL. Performance impact should be negligible, due to the TLS optimizations in use. ## PCI CDN Customers who have PCI-enabled accounts and load their assets from `cdn-pci.optimizely.com` have all of their assets served over TLS. ## Ciphersuites Ciphersuites are reviewed at least annually and updated to address security risks and meet PCI compliance requirements for TLS. ## Opt out of TLS Optimizely has an alternative CDN at `cdn-s-optional.optimizely.com` for customers who want to opt-out of TLS. This domain points to Optimizely's same primary CDN but does not send the HSTS header. To transition to this CDN, change your `cdn.optimizely.com` URLs to point to `cdn-s-optional.optimizely.com`.  For information on how to change your `cdn.optimizely.com` URLS to `cdn-s-optional`, see [Implement the one-line JavaScript snippet](docId\:Eynqg8Z-62r76dvDho6dx) and change `