Optimizely's September 2026 Short-Term Support (STS) release for Configured Commerce, version 5.2.2609.386+sts, introduces several improvements focused on storefront reliability, security, accessibility, and multilingual support. Highlights include automatic search failover, expanded Content Security Policy controls, keyboard-accessible Admin Console workflows, and simplified multilingual URL structures.

The most important update, however, is the migration to Spreedly's Web Checkout SDK, which comes with a mandatory upgrade deadline for customers using Optimizely's Payment Service.

Here is my take on what matters most and what development teams should pay attention to before their next deployment.

An Important Deadline for Payment Service Customers

The biggest item in this release is the transition from Spreedly's legacy iFrame payment capture to the new Spreedly Web Checkout SDK.

Spreedly is retiring its legacy iFrame in Q1 2027, which means Configured Commerce customers using the Payment Service must upgrade to version 5.2.2609 or later by December 31, 2026. Sites that miss this deadline risk disruptions to card capture and payment processing.

Fortunately, Optimizely has made this transition relatively straightforward. Existing merchant and gateway configurations, including 3D Secure (3DS) and Strong Customer Authentication (SCA) settings, carry over automatically without requiring manual reconfiguration.

That said, I would still recommend thorough regression testing of your checkout flows, especially if your implementation includes custom payment logic or gateway integrations. Payment processing is not an area where you want to discover compatibility issues after deploying to production.

The September release also fixes an issue where One Page Checkout failed to display an error when shoppers entered invalid eCheck account or routing numbers. This is worth verifying if your site recently adopted the ACH functionality introduced in July.

Improvements to Multilingual URLs and SEO

One of the more useful enhancements for international storefronts is the new unified URL structure for multilingual catalogs.

Previously, language URL segments could behave inconsistently across different page types, including duplicate segments appearing on brand pages. The September release introduces the Use Home Page Url Segment Across Catalog Pages setting, which consistently applies the homepage language segment to catalog, product, brand, and search pages.

For example, a multilingual storefront can now maintain a consistent /en/ or /fr/ language prefix across its catalog instead of managing language indicators independently throughout the site.

This is a welcome improvement for SEO and URL management, particularly for businesses maintaining multiple localized catalogs.

The setting is enabled automatically for new websites but remains disabled for existing ones to preserve established URL structures.

If you are considering enabling it on an existing production site, I would first review your current URLs, redirects, canonical tags, and hreflang configuration. Even a beneficial URL change can create SEO headaches if existing indexed pages are not handled correctly.

The release also improves language configuration by automatically generating missing page URLs when languages are created or updated. Combined with a default-language fallback, this addresses scenarios where enabling or disabling a language could previously leave storefront pages inaccessible.

What's New for Configured Commerce Administrators?

The Admin Console receives several improvements aimed at accessibility and everyday usability.

Administrators can now reorder supported lists entirely through keyboard navigation, with translated screen-reader announcements confirming changes. This functionality extends to product images, list columns, export columns, promotion rule groups, user roles, product relationships, and multi-value settings.

For organizations working toward accessibility compliance, these changes help make important administrative workflows accessible to users who cannot rely on mouse navigation.

Another small but useful addition is a visual indicator for custom properties that have no stored value. Previously, it could be difficult to distinguish between a property displaying its default value and one that had actually been saved to the database. Anyone who has spent time troubleshooting custom properties in the Admin Console can appreciate why this matters.

Optimizely has also restricted changes to a website's CMS Type to users with the ISC_System role, reducing the risk of accidental configuration changes on hosted environments.

Search Reliability and Security Improvements

Two of the more significant behind-the-scenes improvements address search availability and security configuration.

First, Commerce Search v3 now supports automatic failover to Elasticsearch when Commerce Search v3 becomes unavailable.

This is an important reliability improvement. Search is a critical part of the buying experience, particularly for B2B storefronts with large product catalogs. Having a fallback mechanism reduces the risk of shoppers losing access to product discovery during a search service outage.

Optimizely has also improved the Search Service's internal resource management to help maintain stable memory usage and performance under sustained traffic.

On the security side, the September release introduces additional Content Security Policy (CSP) controls, including a dedicated policy for the Admin Console and report-only modes for both storefront and administrative environments.

The report-only functionality is especially valuable because it allows development teams to identify potential CSP violations before enforcing stricter policies.

If you have implemented CSP headers before, you know how easily third-party scripts, payment integrations, and other external resources can be affected by overly restrictive policies. Being able to observe violations without blocking legitimate functionality makes implementing stronger security controls considerably safer.

Additional Enhancements Worth Noting

A few smaller changes are worth highlighting.

Spire storefronts now support serving files from the /.well-known/ path through the Media Library. Implementers can upload verification and application association files directly to /userfiles/_system/.well-known/ without requiring a custom deployment. This should simplify domain verification, mobile application linking, and other third-party integrations.

Application startup performance has also been improved for installations that do not use Classic CMS websites. Rather than loading every available theme, the application now loads only the themes currently in use.

The release expands the available language tags to include primary languages from the world's top 30 economies and reduces Search Service logging verbosity in Sandbox, Demo, and Production environments to make important warnings easier to identify.

Several bug fixes also address integration jobs getting stuck in progress, missing product search results, authentication issues in Spire, and outdated product recommendations remaining visible when navigating between pages.

Individually, these fixes may not warrant an upgrade, but together they address the kinds of intermittent issues that can be frustrating to diagnose and support.

How I Would Approach This Upgrade

If your Configured Commerce site uses Optimizely's Payment Service, this release should be a priority. The December 31 deadline makes upgrading a requirement rather than simply an opportunity to pick up new features.

For everyone else, the improvements to search reliability, security configuration, and multilingual URL management make a compelling case for evaluating the September STS release.

I would focus regression testing on custom checkout implementations, search behavior, multilingual routing, and any existing Content Security Policy configuration. Teams with custom implementations of the IPathBuilderUtilities interface should also review the newly added methods as part of their upgrade assessment.

As with any STS release, consider your current support requirements, customization footprint, and deployment schedule before upgrading.

Overall, September's release is less about flashy storefront features and more about strengthening the platform's reliability, security, and maintainability. Those improvements may not always be visible to shoppers, but they can make a significant difference to the teams responsible for keeping a commerce site running smoothly.

See the full patch notes here: Optimizely Configured Commerce September 2026 Release Notes.