A security.txt file is a small plain text file, defined in RFC 9116, that tells security researchers how to report a vulnerability to you. It lives at /.well-known/security.txt on your website and must contain two fields: Contact and Expires. Everything else is optional. It takes about five minutes to add.
Key takeaways
- RFC 9116 makes only Contact and Expires mandatory. All other fields are optional.
- Serve it over HTTPS at /.well-known/security.txt as UTF-8 plain text with a text/plain content type.
- Set Expires less than a year ahead, so stale files do not point researchers at dead mailboxes.
- Optional fields include Policy, Encryption, Acknowledgments, Preferred-Languages, Canonical and Hiring.
- It points to your disclosure policy. It is not a policy on its own.
What is a security.txt file?
It is a standard way to publish your security contact. The security.txt site calls it a proposed standard that allows websites to define security policies. RFC 9116 is the specification.
Where does the file go?
At /.well-known/security.txt. RFC 9116 says web-based services must place the file under the /.well-known/ path. A file at the top level, /security.txt, may exist for legacy reasons, and if both exist the one under /.well-known/ is used.
What fields does it have?
Two are required and six are optional. The RFC lists these.
| Field | Required | What it holds |
|---|---|---|
| Contact | Yes | A way to reach you, such as mailto: or a URL. May repeat; order sets preference. |
| Expires | Yes | A date and time when the file goes stale. Once only. |
| Acknowledgments | No | A link to a page that thanks reporters. |
| Canonical | No | The URL or URLs where this file lives. Useful when signing. |
| Encryption | No | A link to your public key, not the key itself. |
| Hiring | No | A link to security job openings. |
| Policy | No | A link to your vulnerability disclosure policy. |
| Preferred-Languages | No | Language tags for reports. English is assumed if absent. |
What does a security.txt file look like?
Here is an example with sample values. Replace the addresses with your own and set a real date.
# Report security issues here
Contact: mailto:security@example.com
# Our disclosure policy
Policy: https://example.com/security-policy
Preferred-Languages: en
Expires: 2027-06-30T23:59:00z
What are the format rules?
Plain text, UTF-8, HTTPS. RFC 9116 says the file must be plain text encoded in UTF-8, must be served with a Content-Type of text/plain with the charset set to utf-8, and must be accessed over HTTPS. It recommends signing the file with an OpenPGP cleartext signature, but does not require it.
How long should Expires be?
Less than a year. The RFC recommends an Expires value less than a year in the future to avoid staleness. Put a calendar reminder to renew it, and see our guide to deploying and validating security.txt with an expiry check.
How to add one
- Create a mailbox or form that a person monitors, such as security@your domain.
- Write the file with Contact and Expires, and add Policy if you have a policy.
- Serve it at /.well-known/security.txt over HTTPS with the text/plain content type.
- Fetch it with curl and check the headers and the date.
- Set a reminder to renew it before the Expires date.
- Link it to a disclosure policy. See how to write a vulnerability disclosure policy.
Frequently asked questions
Is security.txt required by law?
RFC 9116 is a standard, not a law. Some regulations and customer contracts may ask for a vulnerability reporting channel, and security.txt is a simple way to publish one.
Do I need to sign the file?
No. RFC 9116 recommends an OpenPGP cleartext signature but does not require it.
Can I use a web form instead of an email address?
Yes. Contact can be a mailto: link or a URL, and the field may appear more than once, with the order setting your preference.
What happens if the file expires?
RFC 9116 recommends a short Expires window precisely to avoid stale files, so a lapsed date signals the contact may be out of date. Renew it before the date.
Does it replace a bug bounty or VDP?
No. It points to them. See bug bounty vs vulnerability disclosure program.
Sources
Last reviewed: 19 October 2026.
