security.txt is a plain text file in which an organization states how to report security vulnerabilities on its website. RFC 9116 defines the format. Researchers find a contact in a machine-readable form instead of guessing an address.
At a glance
- Type
- text file for security contacts
- Status
- RFC 9116 (informational, April 2022)
- Location
/.well-known/security.txt- Values
- required fields
ContactandExpires - Docs
- RFC 9116
Last checked:
How is a security.txt file set up?
The file belongs at https://example.com/.well-known/security.txt. The RFC allows /security.txt in the root as a legacy location, and if both exist, the /.well-known/ file wins. It must be served over HTTPS as text/plain in UTF-8.
Two fields are required. Contact says how to report an issue (email, phone or web URI). Expires sets the date after which the data counts as stale, and the RFC recommends a value less than a year ahead. Optional fields are Acknowledgments, Canonical, Encryption, Hiring, Policy and Preferred-Languages. The RFC recommends signing the file with an OpenPGP cleartext signature.
According to the RFC, the file applies only to the host it was retrieved from, not to subdomains or parent domains. CISA likewise advises a file for each domain and subdomain.
| File | Standard or proposal? | Location | Purpose | Who reads it (documented) |
|---|---|---|---|---|
| robots.txt | IETF standard: RFC 9309 (September 2022) | / | tells crawlers which URLs they may fetch; per the RFC not a form of access authorization | Crawlers; Google's common crawlers always respect it for automatic crawls |
| llms.txt | Proposal (Jeremy Howard, 2024; version 2 from August 2026) | / or in a subpath | Markdown overview linking to Markdown versions of pages, for AI agents | per the proposal mainly coding agents; Google Search ignores it, says Google; Lighthouse only checks the fetch |
| llms-full.txt | no specification; not part of the llms.txt proposal, a convention of individual vendors (e.g. Mintlify) | / (Mintlify also serves /.) | entire documentation as Markdown in one file | no reader documented; Google Search doesn't use such files, says Google |
| ai.txt | Individual IETF Internet-Draft (June 2026, expires 2026-12-14), not a standard; predecessor by Spawning (2023) | /. (draft), / (Spawning) | AI usage preferences (training, scraping, indexing, caching), licensing, attribution | no reader documented in primary sources; Google Search doesn't use 'AI text files', says Google |
TDMRep (tdmrep.) | W3C Community Group Final Report (2024-05-10), not a W3C standard | /., HTTP header tdm-reservation or HTML meta tag | machine-readable reservation of text and data mining rights (Art. 4 DSM Directive) | parties performing text and data mining (per the specification) |
| security.txt (this term) | RFC 9116 (April 2022, informational, not standards track) | /. | contact for reporting security vulnerabilities; required fields Contact and Expires | Security researchers |
| ads.txt | IAB Tech Lab specification, version 1.1 (August 2022) | / on the root domain, subdomains as needed | declares the companies authorized to sell the site's ad inventory | advertising systems and buyers (ad system crawlers) |
| humans.txt | Initiative (humanstxt.org), no formal specification | / next to robots.txt, optionally linked via rel="author" | names the people who contributed to the website | people who want to know who is behind the website |
Only robots.txt, security.txt and ads.txt are based on a finalised specification (IETF or IAB Tech Lab). Google states that Google Search doesn't use new machine-readable files or 'AI text files' and ignores llms.txt files, which neither help nor harm Search visibility. TDMRep is a technical way to express the reservation under Art. 4 of Directive (EU) 2019/790. Not legal advice. Sources: RFC 9309: Robots Exclusion Protocol; Google: Overview of Google crawlers and fetchers (last updated 2026-06-12); The /llms.txt file, v2 (llmstxt.org); llmstxt.org: Changes (v2, August 2026); Google Search Central: Optimizing for generative AI features (last updated 2026-07-10); Chrome for Developers: Lighthouse llms.txt audit (2026-05-05); Mintlify: llms.txt and llms-full.txt; IETF Internet-Draft draft-car-ai-txt-wellknown-00 (2026-06-12); W3C TDMRep Community Group: TDM Reservation Protocol, Final Report 2024-05-10; RFC 9116: A File Format to Aid in Security Vulnerability Disclosure; IAB Tech Lab: ads.txt; IAB Tech Lab: ads.txt Specification Version 1.1 (GitHub); humanstxt.org. Last checked: .
Example
Contact: mailto:security@example.com
Expires: 2027-06-30T23:59:00.000Z
Preferred-Languages: en, de
Canonical: https://example.com/.well-known/security.txt
Common mistakes
Expireslies in the past, so the contact data counts as stale.ContactorExpiresis missing, although both are mandatory.- The file is reachable only over HTTP.
- Only the main domain has a file, while subdomains have none.
FAQ
Is security.txt a ranking factor? No source in this entry says so. The file serves security reporting.
Is security.txt mandatory? RFC 9116 defines a format and does not make the file compulsory. CISA recommends that organizations publish one.
Sources
Last updated: