Hosting the key file

To verify a domain, the file named after your key (for example 3f7c…e1.txt) must be served at the root of your domain. Copy the file name, content and address from the Verify domain dialog on the domain page.

Whatever platform you use, the file must:

• Be served at https://your-domain/your-key.txt, on the exact host you added to Raylit.
• Answer with HTTP 200 and the key as the whole body. A trailing newline is fine; HTML around it is not.
• Stay on that host, or redirect that path with HTTP 301 or 302 to the hosted key URL in the Verify dialog. Raylit follows a redirect that stays on the same host. The only other host it accepts is that exact URL. A redirect to www., or to any other address, is rejected and not requested. If the site lives on www, add www as the domain.

IndexNow fetches this URL on its own. Search engines crawl the key location to verify ownership, and IndexNow accepts a URL reached by a 301 or 302 (documentation, FAQ). Prefer a direct HTTP 200 when you can host the file. When you cannot, use Verify with a redirect.

Static sites and frameworks#

Most frameworks copy a public folder to the root of your site as is. Save the key file there and deploy:

• Next.js, Vite, Create React App, Nuxt 3, Astro: the public/ folder.
• Laravel: the public/ folder.
• Ruby on Rails: the public/ folder.
• Hugo: the static/ folder.
• Jekyll and plain HTML sites: the root of the site.

Netlify, Vercel and Cloudflare Pages#

These hosts serve the files your build produces. Add the key file to your framework's public folder (see above) so it ends up at the root of the build output, then redeploy. Make sure no redirect or rewrite rule (in _redirects, netlify.toml or vercel.json) catches the key file's path.

WordPress#

Upload the key file to the folder WordPress is installed in, next to wp-config.php, using your host's file manager or SFTP.

If an SEO plugin already hosts an IndexNow key for your site, you can use that key instead: paste it under Replace key in the domain settings.

Hosted site builders#

Some hosted site builders do not let you put an arbitrary file at the root of your domain. Webflow and Squarespace are in that group. Redirect the key path to Raylit instead of hosting the file. The steps for Webflow, Squarespace, and Cloudflare redirect rules are in Verify with a redirect.

Auth-gated sites#

Sites that send unknown paths to a sign-in page (an auth middleware, a locale redirect onto a login wall) fail verification for a specific reason: Raylit follows the same-host redirect, lands on the sign-in page, and that page is not the key. The error names the path it was sent to.

Allow the key file without a login. Exempt /{your-key}.txt in the middleware so a signed-out request gets HTTP 200 and the key as the entire body, then press Recheck. Do not send that path to /sign-in. A redirect to another host is not a workaround unless it is a 301 or 302 to the hosted key URL in Verify with a redirect. Raylit does not follow any other cross-host redirect.

Firewalls and bot protection#

If Raylit's check passes but IndexNow rejects submissions with HTTP 403, something is usually blocking IndexNow's fetcher (Bingbot) from reading the file: a firewall rule, bot fight mode, a challenge page or geo-blocking. Allow Bingbot, or skip protection for your key file's path, then press Recheck on the domain page to submit again.

Changing the key#

Under Replace key in the domain settings you can paste a key your domain already hosts (for example one set up by another IndexNow tool), or leave the field empty to generate a new one. Each domain needs its own key. The domain stays unverified until the new key file is found.