What is security.txt and does my website need one?

Last reviewed

security.txt is a small text file that tells security researchers how to contact you. It’s a published internet standard (RFC 9116).

If someone notices a problem on your site, it means you hear about it from them rather than from your customers.

Check your own site for this in about a minute

There’s no way for researchers to report problems to you

What it is. Your site has no /.well-known/security.txt file.

Why it matters. People who spot a problem can’t easily tell you, so you may never hear about it.

Time to fix. About 5 minutes

Any host

Create /.well-known/security.txt containing:
Contact: mailto:security@example.com
Expires: 2027-12-31T23:59:00.000Z