Stack playbook · Snapshot 23 October 2026
Next.js on Netlify: readiness playbook
What 150 measured sites on this stack get right, where they fall short, and the Next.js on Netlify-specific steps that close each gap.
- Sites measured
- 150
- Median readiness index
- 76/100
- Profiles on this stack
- 21
detected from homepage HTML and headers
all sites: 64
top-50K sites
Readiness by lane
Enable
89/100
All sites 77
Harden
72/100
All sites 55
Accelerate
72/100
All sites 63
Recover
8/100
All sites 11
The Next.js on Netlify playbook
Gaps ordered by impact, with the platform-specific step where one exists.
HTTP/3 advertised
11% observed · all sites 36%
Turn on HTTP/3 at your CDN. Browsers fall back to HTTP/2 automatically, so the risk is low.
security.txt published
12% observed · all sites 5.5%
Publish /.well-known/security.txt with at least Contact and Expires fields, as RFC 9116 requires, and review it before it expires.
Modern image formats in use
43% observed · all sites 40%
Serve WebP or AVIF with a JPEG or PNG fallback, either through an image CDN or by generating both formats at build time.
On Next.js: The next/image component serves optimized formats automatically.
Guide: AVIF, WebP, JPEG, and PNG: Choose the Right Image Format
No render-blocking scripts in <head>
33% observed · all sites 44%
Add defer to scripts that need the DOM, async to independent ones such as analytics, or move them to the end of the body.
On Next.js: Use the next/script component with an appropriate loading strategy.
Guide: Control Third-Party Scripts Before They Control Your Page
CAA records limit who can issue certificates
16% observed · all sites 11%
Publish CAA records naming every CA you actually use, including the CAs your CDN uses for managed certificates. Add an iodef contact if you want reports.
DNSSEC signed
15% observed · all sites 8.1%
Enable DNSSEC at your DNS provider, then add the DS record at your registrar. Plan provider moves carefully: a stale DS record can make the domain fail to resolve.
Guide: Website Uptime Readiness: Prepare Before Traffic Arrives
DMARC policy enforces quarantine or reject
59% observed · all sites 31%
Publish DMARC with p=none and a reporting address first, fix any legitimate senders that fail SPF or DKIM alignment, then move to quarantine and finally reject.
Content Security Policy present
42% observed · all sites 31%
Start with Content-Security-Policy-Report-Only to see what would break, tighten the policy over a few weeks, then enforce it.
On Next.js: Next.js documents nonce-based CSP with middleware.
Guide: Payment Security and PCI DSS: What Website Owners Need to Know
Where Next.js on Netlify sites lead
- HSTS kept for at least a year95% observedall sites 31%
- X-Content-Type-Options: nosniff97% observedall sites 48%
- Static files cached for 30 days or more89% observedall sites 50%
- Offscreen images lazy-loaded93% observedall sites 61%