How to publish a security.txt
security.txt tells researchers where to report a vulnerability. It is a small text file at /.well-known/security.txt.
Step by step, with screenshots: security.txt: the contact file for security researchers →
Check your own site
Runs this check and the other 192, free, in about 45 seconds.
What it is
security.txt is a small plain-text file, defined in RFC 9116, that tells security researchers how to report a vulnerability in your website. It lives at /.well-known/security.txt and lists at least a contact address and an expiry date.
When someone finds a problem, such as an exposed file or a cross-site scripting hole, they need a quick way to reach the right person. Without security.txt, reports go to a general inbox, a social media account or nowhere at all. getReport checks whether the file exists. It is optional but takes about five minutes to add; the file is OK when its Contact works and its Expires date is in the future.
What a passing site looks like
- security.txt is presentinfo onlyeffort S
No security.txt file
Why it matters. security.txt (RFC 9116) tells security researchers where to report a problem with your site. Without it, a report may never reach you.
- Publish /.well-known/security.txt with a Contact line and an Expires date less than 1 year away.
Questions people ask
Where do I put security.txt?
Serve it at https://yourdomain/.well-known/security.txt as plain text over HTTPS. A copy at /security.txt is allowed for older tools, but the .well-known path is the standard. In WordPress and other CMSs, upload it to a .well-known folder in the site root with your host's file manager; some security plugins can create it for you.
What is /.well-known/security.txt?
It is the standard location for a site's security contact file. The /.well-known/ folder is reserved, by RFC 8615, for files that tools expect at fixed paths, such as security.txt and the MTA-STS policy. Researchers and scanners request /.well-known/security.txt automatically to find out where to report a vulnerability.
What should a security.txt file contain?
Two fields are required: Contact, an email address written as mailto: or the URL of a web form, and Expires, a date and time in ISO 8601 format, ideally less than a year ahead. Optional fields include Policy for your disclosure rules, Preferred-Languages, Acknowledgments and Encryption for a public key. For example: Contact: mailto:security@example.com and Expires: 2027-06-30T23:00:00Z.