the /.well-known/ directory where security certs and other sensitive documents reside

If my certificates live in .well-known, then I can only conclude that my host has aliased the directory to some entirely different location on the server, putting the whole thing out of my control.

@ lucy24 - it's where is says it is, but hidden.

I redirect requests for dnt-policy.txt to where I can see it. The bots still look for it where they think it should be, but I give it to them from another place.

I do this with a couple other files that are supposed to be in the /.well-known/ directory. The cert still stays there because it's programed to update there. Don't mess with that :)

Only way to do it with this type of host it seems.

it's where is says it is, but hidden

Well, ###. You mean my host has the power to make directories within my userspace invisible to me? Hmph.

Fetch prefs has an interesting phraseology, “hidden items whose names begin with a period”, implying that those are two separate factors, so there could be hidden items whose names do not begin with a period, or visible items whose names do begin with a period. Except that I’m pretty sure it doesn’t mean that at all, and it’s just the usual “hide/show items whose names begin with a period”.

Back to topic...

Ignoring Do Not Track compliance risks violation of other GDPR requirements.

Do Not Track Compliance Policy can also be an HTML, PHP or similar file outlining compliance.

Additional help: How a site can comply with Do Not Track [baycloud.github.io]