diff --git a/DysonNetwork.Zone/DysonNetwork.Zone.csproj b/DysonNetwork.Zone/DysonNetwork.Zone.csproj
index 54f17db..05b32cf 100644
--- a/DysonNetwork.Zone/DysonNetwork.Zone.csproj
+++ b/DysonNetwork.Zone/DysonNetwork.Zone.csproj
@@ -18,6 +18,11 @@
             <PrivateAssets>all</PrivateAssets>
             <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
         </PackageReference>
+        <PackageReference Include="MimeKit" Version="4.14.0" />
+        <PackageReference Include="MimeTypes" Version="2.5.2">
+          <PrivateAssets>all</PrivateAssets>
+          <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+        </PackageReference>
         <PackageReference Include="NodaTime.Serialization.Protobuf" Version="2.0.2" />
         <PackageReference Include="NodaTime" Version="3.2.2" />
         <PackageReference Include="NodaTime.Serialization.SystemTextJson" Version="1.3.0" />
diff --git a/DysonNetwork.Zone/Publication/SiteManagerController.cs b/DysonNetwork.Zone/Publication/SiteManagerController.cs
index 607965f..8cb2626 100644
--- a/DysonNetwork.Zone/Publication/SiteManagerController.cs
+++ b/DysonNetwork.Zone/Publication/SiteManagerController.cs
@@ -206,19 +206,30 @@ public class SiteManagerController(
 
     [HttpGet("content/{**relativePath}")]
     [Authorize]
-    public async Task<ActionResult<string>> GetFileContent(Guid siteId, string relativePath)
+    public async Task<IActionResult> GetFileContent(Guid siteId, string relativePath)
     {
         var check = await CheckAccess(siteId);
         if (check != null) return check;
 
+        string fullPath;
         try
         {
-            var content = await fileManager.ReadFileContent(siteId, relativePath);
-            return Ok(content);
+            fullPath = fileManager.GetValidatedFullPath(siteId, relativePath);
         }
-        catch (FileNotFoundException)
+        catch (ArgumentException)
         {
+            return BadRequest("Invalid path");
+        }
+
+        if (!System.IO.File.Exists(fullPath))
             return NotFound();
+
+        // Determine MIME type based on file extension
+        var mimeType = GetMimeType(relativePath);
+
+        try
+        {
+            return PhysicalFile(fullPath, mimeType);
         }
         catch (Exception ex)
         {
@@ -246,18 +257,18 @@ public class SiteManagerController(
         if (!System.IO.File.Exists(fullPath))
             return NotFound();
 
-        // Determine MIME type
-        var mimeType = "application/octet-stream"; // default
-        var ext = Path.GetExtension(relativePath).ToLowerInvariant();
-        if (ext == ".txt") mimeType = "text/plain";
-        else if (ext == ".html" || ext == ".htm") mimeType = "text/html";
-        else if (ext == ".css") mimeType = "text/css";
-        else if (ext == ".js") mimeType = "application/javascript";
-        else if (ext == ".json") mimeType = "application/json";
+        // Determine MIME type based on file extension
+        var mimeType = GetMimeType(relativePath);
 
         return PhysicalFile(fullPath, mimeType, Path.GetFileName(relativePath));
     }
 
+    private static string GetMimeType(string fileName)
+    {
+        var ext = Path.GetExtension(fileName);
+        return MimeTypes.TryGetMimeType(ext, out var t) ? t : "application/octet-stream";
+    }
+
     [HttpPut("edit/{**relativePath}")]
     [Authorize]
     public async Task<IActionResult> UpdateFile(Guid siteId, string relativePath, [FromBody] UpdateFileRequest request)