Fill in the details once to generate staging test instructions — copy as text or export as PDF to send to a customer.
0 / 5 steps
Setup
Applies to every step
Fill this in once — every command below updates to match. Add a row per hostname if the property has more than one.
Pasting into the box fills the rows automatically. An edge hostname is paired with its hostname whether it sits on the same line or a few lines below it — so a copy of the Control Center Property Hostnames table works as-is. Surrounding text, numbering, table pipes, IN CNAME and status text such as Multiple certificates / Manage in CPS / Validated are ignored.
Your OS
Prerequisites
Before you start
The property version you want to test is activated on the staging network (not just saved as a draft).
If the property uses a custom HTTPS certificate, it's been manually pushed to staging — CPS-managed certificates deploy to production by default and won't be on staging automatically.
You have permission to edit your machine's hosts file (admin/root), and you're not connected over VPN — VPN clients frequently override hosts-file entries and DNS, which silently defeats this whole test.
1. Resolve the staging edge server IP
Edge
Insert -staging right before the final .net in the edge hostname — that's the staging edge hostname. Suggested tool: nslookup (works the same on Windows, macOS and Linux).
Live lookup via Google Public DNS — auto-fills the Staging IP field(s) above — also runs automatically when you leave the Edge hostname field
2. Point your machine at staging
Client
Redirect only your own machine — this never touches public DNS or affects other users.
Open your hosts file:
Add one line per hostname at the bottom, in the format <staging IP> <production hostname> — copy the whole block below as-is:
Save the file, then flush your DNS cache:
RememberRemove these hosts-file lines once testing is done — leaving them in place will keep pinning you to staging even after production go-live.
3. Confirm you're actually hitting staging
Edge
A page loading isn't proof — it may be answering from origin directly. Check the response headers.
Look forThe X-Akamai-Staging header in the response. A value of ESSL or EdgeSuite confirms the request was served from Akamai's staging network. If the header is missing, you're not hitting staging — recheck the hosts-file entry and staging IP from Step 2.
Enhanced Debug (Akamai-Debug header, shown above) needs an auth token from your Akamai account team and returns richer diagnostics if you have one.
4. Functional testing
End to end
Test against your real production hostname — never the edge hostname directly — so the flow matches what users will actually hit.
Check the site's functionality end to end — what to cover depends on the site itself, so use your judgment rather than a fixed checklist.
When you're done: remove the hosts-file entry, flush DNS again, and confirm the site returns to normal. If everything checked out, you're clear to activate the property — and certificate, if custom — on production.
5. Testing the security configuration
App & API Protector
A security configuration is activated and tested separately from the property itself.
The security configuration must be activated on staging first.
You need admin rights to edit the hosts file, and again — avoid testing over VPN.
Familiarity with dig/ping, or a tool like curl/wfetch, is assumed below.
Get a fresh staging IP. Resolve the CNAME chain, then insert -staging and resolve again — repeated below for each hostname:
Test against staging, mimicking real production traffic as closely as possible — realistic paths, headers, and payloads matter here, since WAF and bot rules react to traffic patterns, not just the URL.
Next stepOnce staging results look right, activate the security configuration on production.
B
Related: Bot Manager
Distinguishes helpful bots (search crawlers) from harmful ones (credential stuffing, account takeover) instead of blocking all automated traffic outright. It's a separate product with no staging test flow of its own — worth knowing about if bot-driven traffic patterns affect this property. See the source link below to get started or compare it against web-scraping and account-abuse protection.