When convenient

Security researchers have no way to reach you

What it means

security.txt is a short plain-text file defined by an internet standard, RFC 9116. It lives at https://example.com/.well-known/security.txt and tells anyone who finds a vulnerability on your site how to report it to you.

EverThread asked for that address and did not find a valid file. Either it returned "not found", or it returned a web page, such as your home page or a styled error page, instead of a plain-text file with a Contact: line.

The .well-known folder name starts with a dot, which is why it is easy to miss. Many file managers hide folders like that by default.

Why it matters

People who find security problems on websites, including researchers and customers who notice something odd, need a way to reach the right person. Without a clear contact, many give up, or send it to a general inbox where it gets lost.

A problem reported to you can be fixed before anyone misuses it. The next person to find the same hole may not bother to tell you.

This is a low-priority item next to certificate or redirect problems. Add it when convenient. It costs nothing and does not change how your site looks or works.

How to check your own site

1. Open https://yourdomain.com/.well-known/security.txt in a browser.
2. A working file shows a few lines of plain text, including one that starts with Contact:. If you see a "page not found" message, your home page, or any styled web page, you do not have a valid one.
3. If you added a file but it is not being picked up, check that it is plain text, not HTML, that it has a line starting with Contact:, and that it sits inside the .well-known folder rather than the top folder.

How to fix it

Any website

1. Choose a contact address that someone actually reads. A dedicated address such as security@yourdomain.com works well, and it can simply forward to your main inbox.
2. Create a plain-text file named security.txt using the example below. Replace the email address and domain. Set Expires to a date less than a year away, and add a calendar reminder to update it before then. The official site, securitytxt.org, has a form that builds the file for you.
3. Upload it into a folder named .well-known at the top of your site, so the address is https://yourdomain.com/.well-known/security.txt. Create the folder if it does not exist.
4. Open the address in a browser to confirm it shows your text.

Contact: mailto:security@example.com
Expires: 2027-09-01T00:00:00Z
Preferred-Languages: en
Canonical: https://example.com/.well-known/security.txt

WordPress

1. WordPress does not create this file. Upload it with your host's file manager or an SFTP app into a .well-known folder inside your WordPress root folder, the one that contains wp-config.php.
2. The folder may already exist if your host uses it for certificate checks. Add your file next to what is there and leave the rest alone.
3. Some plugins can create the file for you, but an uploaded file is simpler and does not depend on a plugin staying installed.

Shopify, Squarespace, Wix and other hosted builders

1. These platforms generally do not let you place files in the .well-known folder.
2. If your domain runs through Cloudflare, you can publish the file there instead (see below). Otherwise, check your platform's help pages or ask support whether it offers security.txt.
3. Until then, listing a security contact on your contact page is a reasonable fallback, though it does not replace the standard file.

cPanel hosting

1. Open "File Manager". Click Settings in the top right and tick "Show Hidden Files (dotfiles)" so you can see .well-known.
2. Go into public_html and open .well-known, or create it with "+ Folder".
3. Inside it, click "+ File", name it security.txt, then right-click it, choose Edit, paste in your lines and save.

Cloudflare

1. Cloudflare can serve a security.txt for your domain without any change to your site. Look for the Security.txt option in the Security Center part of the dashboard, fill in your contact and expiry date, and turn it on.
2. The dashboard layout changes from time to time. If you cannot find the option, use the dashboard search.

Apache or Nginx

1. Place the file at .well-known/security.txt inside the document root.
2. Many server configurations deny access to anything whose name starts with a dot. If the file returns 403 or 404, add an exception for /.well-known/ ahead of that rule. The Nginx example below does this.

# Nginx: allow /.well-known/ even if dotfiles are denied elsewhere
location ^~ /.well-known/ {
    allow all;
}

What to send your developer

GET /.well-known/security.txt returned 404, or a 2xx response that was HTML, matched the site's catch-all page, or had no Contact: field. Serve it over https as text/plain; charset=utf-8. RFC 9116 requires Contact (a mailto:, https: or tel: URI) and Expires (an RFC 3339 timestamp, recommended less than a year ahead). Optional fields include Policy, Acknowledgments, Preferred-Languages, Canonical, Encryption and Hiring, and the file may be signed with an OpenPGP cleartext signature. A copy or redirect at /security.txt is allowed for older tools. Automate the Expires refresh in your deploy, since readers are told to treat an expired file as stale.

Common questions