Akamai Web Performance cheat sheet

RTT dominates uncached latency: each new TCP connection costs 1 RTT (3-way handshake) plus TLS handshake RTTs before the first byte of HTTP response.

HTTP/2 multiplexes many streams over one TCP connection, removing per-request connection setup but inheriting TCP head-of-line blocking under packet loss.

HTTP/3 runs over QUIC/UDP with independent streams, so loss on one stream does not stall others; 0-RTT resumption reduces repeat-visit setup.

A CDN serves from an edge PoP near the user; cache hit ratio and origin offload are the two primary CDN efficiency metrics.

Time To First Byte (TTFB) = network round trips + server processing + queueing; edge caching reduces the network and origin components.

DNS resolution is a serial dependency before connection setup; preconnect and DNS prefetch move this work off the critical path.

Bandwidth-delay product bounds in-flight data: throughput is capped by window size divided by RTT on high-latency links.

Anycast routes users to a nearby PoP by advertising the same IP from many locations; routing changes can shift users between PoPs.

A property is a named configuration of rules; a version is an immutable snapshot that must be activated on a network (staging or production) to take effect.

Rule matching is top-down with first match winning unless child rules or match criteria allow fallthrough; order determines which behavior applies.

Behaviors define what happens (caching, origin, header manipulation); match criteria define when (hostname, path, cookie, device, geography).

Property Manager (PAPI) exposes properties, versions, rules, activations, and hostnames via REST; activations are asynchronous and validated before deploy.

A property version must include at least one origin behavior and a hostname mapping before it can serve traffic.

Activation on production is irreversible as a version pointer: rollback is performed by activating a prior version, not by editing live config.

Include rules let shared behavior sets be reused across properties; overrides in the including property take precedence where defined.

Enhanced TLS and standard TLS certificate associations are configured per property hostname; SNI determines which certificate is presented.

Freshness lifetime is governed by Cache-Control max-age or s-maxage; s-maxage applies to shared caches such as CDN edges and overrides max-age there.

TTL precedence at the edge: origin Cache-Control/Expires, then property-level default TTL, then heuristic or no-store depending on configuration.

Cache key components (hostname, path, query string, selected headers/cookies) determine hit rate; each added component fragments the cache.

stale-while-revalidate serves stale content while asynchronously refreshing; stale-if-error serves stale content when the origin fails.

Vary on Accept-Encoding is standard; Vary on User-Agent or Cookie drastically lowers hit ratio and is usually replaced by explicit cache keys.

Purge/invalidate operations remove objects by URL, CP code, or tag; tag-based purging avoids enumerating every URL variant.

CP codes group traffic for reporting and billing and can be used as a purge and behavior scoping unit.

Tiered distribution adds a parent tier between edge and origin to raise edge hit ratio and shield the origin from repeated misses.

Critical rendering path: HTML, then blocking CSS, then render-blocking JS; defer or async scripts and inline critical CSS to shorten first paint.

Preload fetches high-priority resources for the current navigation; prefetch fetches likely next-navigation resources at low priority.

Image optimization: serve modern formats (WebP/AVIF), set explicit width/height to avoid layout shift, and lazy-load below-the-fold images.

Edge compute (EdgeWorkers) and edge-side includes assemble or personalize responses at the edge, reducing origin round trips.

Compression: Brotli typically beats gzip for text; do not compress already-compressed media, and set Vary: Accept-Encoding.

Resource hints: preconnect opens socket plus TLS early, dns-prefetch resolves DNS only, and both should target a small set of critical origins.

HTTP/2+ benefits from domain sharding removal; excessive domains multiply connection setup cost and hurt multiplexing gains.

Measure field metrics (Core Web Vitals: LCP, INP, CLS) at the edge or RUM rather than relying solely on lab synthetic tests.

Synthetic monitoring runs scripted tests from fixed locations on a schedule; RUM captures real user experiences across devices and networks.

Cache hit ratio = cache hits divided by total requests; a sudden drop often indicates a cache-key change, purge storm, or new query-string variance.

5xx from edge usually signals origin errors or timeouts; 5xx generated at edge with short TTFB often indicates configuration or validation failure.

Compare staging versus production activation behavior before promoting; staging uses a separate hostname and network.

Waterfall analysis: separate DNS, connect, TLS, TTFB, and content download to locate whether latency is network, edge, or origin.

Log delivery (DataStream) and reporting APIs give per-request or aggregated metrics; use them to correlate purge/activation events with traffic shifts.

Origin health checks and failover behavior should be verified by simulating origin failure, not assumed from configuration.

Baseline before and after each change; single-sample tests are unreliable because PoP selection and network conditions vary.

Serve all traffic over TLS with HSTS; mixed content defeats transport security and can be blocked by browsers.

WAF rules and rate limiting protect the origin; bot management distinguishes automated traffic from users to preserve capacity.

DDoS mitigation absorbs volumetric attacks at the edge; origin IPs should not be publicly resolvable to prevent direct attack bypass.

Use origin shielding / tiered distribution to limit origin exposure and absorb traffic spikes at the parent tier.

Least-privilege API credentials and role separation for property activation reduce blast radius of misconfiguration.

Change management: validate in staging, activate during low-traffic windows, and keep the prior version ready for rollback.

Set sensible timeouts and retry policies; unbounded retries amplify load during origin degradation.

Monitor certificate expiry, DNS changes, and activation status as leading indicators of outages.