SteadyHost

security.txt: where to report vulnerabilities

If someone finds a security issue on your website, you want them to know who to report it to. That's what security.txt is for: a small text file in a fixed location on your website with your contact details for security reports.

Check your website now

Why security.txt?

security.txt is an open standard (RFC 9116). Security researchers and organizations that report vulnerabilities look for the file in a fixed location: /.well-known/security.txt. Without that file they have to find a contact person themselves, and a report often ends up in a general inbox or nowhere at all.

The Dutch government, for example, recommends using security.txt. For smaller organizations too, it's a simple way to get reports to the right place.

What goes in it

The file consists of lines in the form Field: value. Two fields are required; the rest are optional.

  • Contact (required): where reports should go, for example an email address with mailto: or a web form with https://. You may include several Contact lines.
  • Expires (required): the date after which the file is no longer considered current. Choose a date within a year and update it in time.
  • Preferred-Languages: the languages in which you want to receive reports.
  • Policy: a link to your vulnerability disclosure policy, for example a page about coordinated vulnerability disclosure.
  • Canonical: the address where this file officially lives.

Example

A simple security.txt file looks like this. Write the Expires date in the format year-month-dayThour:minute:second, in UTC.

/.well-known/security.txt
Contact: mailto:security@example.com
Expires: 2027-10-01T00:00:00.000Z
Preferred-Languages: en
Canonical: https://example.com/.well-known/security.txt

Placing the file

Put the file in the .well-known folder in the root of your website, so it's reachable at https://yourdomain.com/.well-known/security.txt. The server must serve it over HTTPS as plain text (Content-Type text/plain).

If you use a CMS such as WordPress, there are plugins that create the file for you. Make sure the email address in Contact is actually read; a reporting address where nobody responds helps no one.

Check it yourself

With curl you can see whether the file is reachable and which Content-Type the server serves it with.

Terminal
curl -si https://example.com/.well-known/security.txt

How SteadyHost rates security.txt

  • OK: a security.txt was found with a Contact line and an Expires date in the future.
  • Warning: there's no security.txt, or Contact or Expires is missing.
  • Problem: the Expires date has passed.
  • This check doesn't count toward the score.

Check your own website

A free check shows within seconds how your website is doing: availability, HTTPS and TLS, the SSL certificate, security headers, DNS and DNSSEC, domain registration and email security.

More guides