Security & Compliance

Customer pentests and vendor security questionnaires often raise findings against Imgix asset URLs — missing security headers, HTTPS enforcement, or content-sanitization checks. Many of these findings assume a full HTML page response, which doesn’t map cleanly onto a CDN serving individual images or video. This guide explains what Imgix secures by default, what’s configurable, what’s intentionally not set on asset responses (and why), and how to read a generic scanner finding against an Imgix URL.

What Imgix Secures by Default

SVG Sanitization

Imgix sanitizes SVGs by default using the svg-sanitize parameter, which is true unless explicitly disabled. This strips script elements, onload and other event-handler attributes, and other potentially harmful content from SVGs before they’re served — useful when you’re rendering SVGs from untrusted sources.

If you need to preserve all original SVG content (for example, when rendering SVGs you fully trust), you can set svg-sanitize=false per-request or as a Source default parameter.

Secure URL Signing

Imgix supports signed URLs, which prevent unauthorized parties from requesting or altering asset URLs. Once Secure URLs are enabled on a Source, every URL served from it must include a valid signature — any URL with a missing or altered signature returns a 403 Forbidden response instead of an asset.

See Securing Assets for how to enable Secure URLs and sign requests.

HTTPS/TLS

All standard *.imgix.net subdomains support HTTPS/TLS automatically — no configuration is required.

Custom Domains

By default, a custom domain only supports HTTP. Serving a custom domain over HTTPS requires an SSL certificate issued through Imgix’s CDN partner. See SSL/TLS Documentation for the certificate issuance and DNS verification process.

HSTS and Forced HTTPS Redirect

HTTP Strict Transport Security (HSTS) instructs browsers to only ever connect to a domain over HTTPS, and can also enforce an HTTP-to-HTTPS redirect at the CDN level. If a pentest or scanner flags a missing Strict-Transport-Security header or a missing forced-HTTPS redirect, reach out to Support to have it enabled for your Source. See Securing Assets for more on Source-level security settings.

What Imgix Does NOT Set on Asset Responses

Imgix does not set Content-Security-Policy, Referrer-Policy, or X-Frame-Options headers on asset responses. These are page-level security headers, designed to control how an HTML document is embedded, framed, or how it leaks referrer information when linking out to other pages. They don’t have a meaningful equivalent for a CDN response serving a single binary asset (an <img>, video, or PDF) — there’s no framing or navigation for a leaf resource to protect, and no outbound links for a referrer policy to govern.

If your application needs these headers, they should be set at your own application or edge layer for the HTML pages that embed Imgix asset URLs, not on the asset responses themselves.

Reading a Pentest or Scanner Finding Against Imgix

Automated scanners frequently flag “missing security header” checks uniformly, regardless of whether the URL being scanned serves an HTML page or a binary asset. Before treating a finding as a gap, check:

• Is the response a binary asset (image, video, PDF) rather than an HTML page? If so, page-level headers like CSP, Referrer-Policy, and X-Frame-Options generally don’t apply — see the section above.
• Is the domain a standard *.imgix.net subdomain, or a custom domain? Standard subdomains have HTTPS/TLS enabled automatically. A custom domain needs a certificate issued first — see SSL/TLS Documentation.
• Does the finding concern SVG content? Confirm svg-sanitize isn’t disabled for the Source or request — see SVG Sanitization above.
• Does the finding concern unauthorized URL tampering? Enabling Secure URLs closes this gap by signing every request.

If a finding doesn’t fit one of the categories above, or you’re unsure whether it applies to your Source’s configuration, contact Support with the specific finding and we can help confirm whether it’s a real gap.

Related Resources

This guide covers the technical, CDN-response side of security triage. For company-level policy and compliance topics — SOC2 reports, GDPR, requesting Imgix’s own pen test results, or vulnerability disclosure — see:

• Security Overview — privacy policy, GDPR, SOC2 compliance, and Imgix’s own pen testing policy
• Vulnerability Reporting — how to report a security vulnerability found in Imgix’s own systems