security.txt file

A file at /.well-known/security.txt naming the address to report a vulnerability to. Nothing requires it; it saves whoever finds something from guessing, and it is three lines long.

• Help center

security.txt (RFC 9116) is a small text file that tells a security researcher where to report a vulnerability they found on your site. Without it, a well-meaning finder has to guess — a generic contact form, a support address, a social-media message — and many give up or post the problem publicly instead. The file is optional, which is why the report shows it as published or not published rather than as an error, but it costs a few minutes to add.

How SiteScan checks

The scan requests /.well-known/security.txt and counts it as published only when the answer is a 200, is not an HTML page, and contains at least one line starting with Contact:. A single-page app that answers every address with its own index therefore does not pass by accident. The legacy location /security.txt in the root is not checked.

How to add one

Serve a plain-text file at /.well-known/security.txt with at least these fields:

• Contact: mailto:security@example.com (or an https:// URL of a reporting form)
• Expires: 2027-12-31T23:59:00Z — required by the RFC; keep it under a year ahead and renew it
• optionally Policy:, Preferred-Languages: en and Encryption: pointing at a PGP key

Make sure the server sends it as text/plain. Related checks: files left behind and security headers.