In short. Use a directory pattern such as /templates/* in _headers or a netlify.toml headers table, then inspect the deployed response headers.
Definition: As of 17 October 2026, Netlify supports directory response-header patterns such as
/templates/*in_headersornetlify.toml.
Key facts
- Netlify's custom headers documentation supports wildcards and named placeholders in header paths.
- Netlify's file-based configuration reference shows response header values inside
[headers.values]tables. - Google's Network panel reference explains how Chrome DevTools displays the response headers for an individual request.
Where does the directory rule go?
A response header is a field returned with an HTTP response. Netlify's file-based configuration reference shows how to define these fields in netlify.toml, normally stored at the repository root. This adapted example applies the documented configuration syntax to a directory path:
[[headers]]
for = "/templates/*"
[headers.values]
X-Frame-Options = "DENY"
The configuration file keeps the path and its header values together. A separate [[headers]] table holds each additional rule.
Netlify's custom headers documentation places _headers in the deployed publish directory. Its equivalent example uses an indented header:
/templates/*
X-Frame-Options: DENY
How do wildcards and placeholders differ?
Netlify's path matching documentation permits a wildcard (*) anywhere within a path segment. A placeholder starts its segment with : and excludes /:
/templates/*
/templates/:name
The forms cannot share a segment: /templates/:placeholder* and /templates/*:placeholder are invalid.
How can the deployed rule be checked?
Google's Network panel reference describes selecting a request in the Name column, opening Headers, and reading Response Headers. For the example above, the field to inspect is X-Frame-Options, with the configured value DENY.
A practical check compares a deployed file beneath /templates/ with a file outside that directory. The request selected in DevTools should correspond to the intended file. Testing a deeper path and the directory URL separately also checks the actual URLs the website serves.
The same reference provides view source beside the response headers to inspect their received order. DevTools also permits local response-header overrides, so the recorded deployed response is the relevant evidence when checking a Netlify configuration change.
Related terms
- How do I set noindex headers on Netlify?
- Do Netlify custom headers apply to function responses?
- How do I redirect a URL directory on Netlify?
FAQ
Does this work for a function response?
Netlify's custom headers documentation restricts rules to stored files. Functions, edge functions and proxied responses supply their own headers.
Can I limit a rule to a deploy context?
Netlify's configuration reference says headers in netlify.toml apply globally across builds. It links a workaround for producing different headers for individual deploy contexts.
Sources
- Netlify, "Custom headers", 1 December 2025
- Netlify, "File-based configuration", 17 September 2026
- Google, "Network features reference", 16 July 2024
Check how a page reads to answer engines. Open the GEO score analyzer