ads.txt authorized sellers file
A file at /ads.txt naming the exchanges allowed to sell this site advertising. It only concerns sites that sell ads; on those it is what stops the domain being spoofed in a bid request.
ads.txt ("Authorized Digital Sellers", an IAB Tech Lab specification) is a public list of the ad exchanges and resellers allowed to sell advertising space on your site. Buyers check it before bidding: an impression offered for your domain by a seller not on the list is treated as fraudulent. That is what stops someone else from selling fake inventory under your name and drawing down the price of the real thing.
It only matters for sites that sell programmatic advertising. A site without ads does not need one, and the report never marks its absence as a fault.
How SiteScan checks
The scan requests /ads.txt without following redirects and counts it as published only when the answer is a 200, not HTML, and contains at least one line in the defined format: exchange domain, publisher account ID, and DIRECT or RESELLER, separated by commas. A file with no valid line — or an HTML page served at that address — reads as not published.
How to publish one
Your ad network or exchange provides the exact lines; a typical entry looks like google.com, pub-0000000000000000, DIRECT, f08c47fec0942fa0. List every partner, keep the file in the root of the domain, serve it as text/plain, and update it whenever you add or drop a seller. Remember that ad scripts also affect speed and privacy — see third-party scripts.
See this check on your own site
Run a free scan: the report shows this row for your domain along with the other checks of the site audit.
More in “Well-known files”
What SiteScan checks
TLS certificate
- TLS certificate expiry
- Outdated TLS versions (TLS 1.0/1.1)
- TLS certificate chain
- TLS certificate issuer
- Certificate signature algorithm
Domain registration
- Domain registration expiry
- Registered domain name
- Domain registrar
- Domain registration date
- Domain last updated date
- Domain status codes (EPP)
- Domain transfer lock
- Registrar abuse contact
- RDAP and WHOIS data source
Indexing
- robots.txt file
- CSS and JS blocked in robots.txt
- XML sitemap
- Sitemap index file
- Off-domain URLs in the sitemap
- Sitemap lastmod dates
- Broken URLs in the sitemap
- RSS and Atom feed
Addresses & redirects
Security headers
- HTTP security headers and grade
- Strict-Transport-Security (HSTS) header
- Content-Security-Policy (CSP) header
- X-Content-Type-Options: nosniff
- X-Frame-Options and clickjacking
- Referrer-Policy header
- Permissions-Policy header
- HSTS preload list
- CORS and cross-origin reads
- HTTP TRACE method
Delivery & reputation
- Cache-Control header for HTML
- ETag and Last-Modified revalidation
- HTTP/3 and QUIC support
- Server version disclosure in headers
- DNS blocklist (DNSBL) check
Internal links
Exposure
- Exposed sensitive files (.env, .git, backups)
- Directory listing enabled
- Public JavaScript source maps
- Exposed WordPress endpoints
Well-known files
- security.txt file
- llms.txt for AI assistants
- llms-full.txt file
- ads.txt authorized sellers file
- humans.txt file
- Well-known change-password URL
DNS & email
- MX records (mail servers)
- SPF record
- DMARC record and policy
- DNSSEC signing
- CAA record
- Nameserver redundancy
- IPv6 support (AAAA record)
- MTA-STS policy
- TLS-RPT reporting record
- BIMI record (brand logo in email)
- Wildcard DNS record
- Dangling CNAME and subdomain takeover
Privacy & consent
- Analytics and tracking scripts
- Cookie consent banner
- Privacy policy link
- Terms of service link
- Imprint (Impressum)
- Accessibility statement
Core Web Vitals
- Lighthouse performance score
- Largest Contentful Paint (LCP)
- Cumulative Layout Shift (CLS)
- Interaction to Next Paint (INP)
- CrUX field data vs lab data