What is a security.txt file and do I need one?
A standard file telling researchers how to report a vulnerability. Five lines, and it is the difference between a private report and a public one.
A plain text file at /.well-known/security.txt giving a contact for security reports. Defined by RFC 9116. Without one, someone who finds a flaw in your site has to guess who to tell — and often gives up or posts publicly instead.
The problem it solves
Somebody finds a vulnerability in your site. They want to tell you. They try security@ and it bounces, the contact form goes to sales, and the support address replies with a ticket number. After an hour of trying, a meaningful proportion give up — and some publish instead.
security.txt is the convention that removes the guesswork. It costs five minutes.
What it contains
Contact: mailto:security@example.com
Expires: 2027-01-01T00:00:00.000Z
Preferred-Languages: en
Canonical: https://example.com/.well-known/security.txt
Policy: https://example.com/security-policy| Field | Required | Purpose |
|---|---|---|
Contact | Yes | Email, URL or phone. List several in preference order. |
Expires | Yes | When this information stops being trustworthy. Keep it within a year and renew. |
Preferred-Languages | No | Languages your team reads. |
Canonical | No | Where the authoritative copy lives. |
Policy | No | Your disclosure policy, if you have one. |
Acknowledgments | No | A page crediting reporters. Costs nothing, and researchers value it. |
Encryption | No | A PGP key for sensitive reports. |
Where it goes
- Primary location:
/.well-known/security.txt. This is where tools and researchers look. - A copy at
/security.txtis permitted for legacy reasons. - Serve it over HTTPS with content type
text/plain. - Make sure your framework does not intercept
/.well-known/and return a 404 — a surprisingly common problem.
Expires field is mandatory and is the one people get wrong. An expired security.txt is treated as unreliable, which is worse than none — a researcher who sees a date two years past assumes the address is dead. Put a calendar reminder against it.The part that matters more than the file
Publishing a contact commits you to reading it. A security.txt pointing at an unmonitored inbox is a promise you are not keeping, and the reporter's next step after silence is usually public disclosure.
- Route the address to somewhere a person actually looks, daily.
- Acknowledge receipt within a few days, even if you have not fixed anything.
- Say what you will and will not do — whether you offer a bounty, whether you will pursue legal action, what testing is acceptable.
- Credit reporters if they want it.
The last point is worth taking seriously. Most people reporting a flaw want it fixed and want acknowledgement. Both are cheap.
What our audit reports about this
Every item below is measured directly, not inferred. Run it against your own site and the result names the exact rule or header responsible.
- Whether
/.well-known/security.txtexists and is served correctly. - Whether the required Contact and Expires fields are present.
- Whether the Expires date has passed.
- Whether any security contact is discoverable elsewhere on the site.
For agents and scripts, the same measurement is at
/api/v1/security?url=yoursite.com —
see the API documentation.
Related questions
Is security.txt required by law?
No, though some sector standards and procurement processes now expect it. It is a convention with real practical value rather than a legal obligation.
Does it invite attacks?
No. Anyone attacking you was not waiting for permission. It changes who hears about a flaw first — you, rather than everyone.
What if I am a one-person site?
Publish an address you read. The file does not promise a security team, only a route. That is enough.
Read next
Is my website secure? How do I check?
What you can verify yourself in twenty minutes, what needs tooling, and what "secure" does and does not mean.
ReadShould I put my email address on my website?
Yes. The spam argument is weaker than it was, and being uncontactable costs more than the spam does.
ReadHow do I make my website look trustworthy?
The signals people and machines actually use — most of which cost nothing and are missing from most small sites.
ReadI found an API key in my HTML. What now?
Rotate first, investigate second. Then work out whether the key ever needed to be in the browser at all.
Read