# security.txt

Category: [Technical SEO](https://seo-geo-glossary.com/en/glossary/category/technical-seo/) › [CMS, operations & special files](https://seo-geo-glossary.com/en/glossary/category/technical-seo/cms-operations-special-files/)

**security.txt** is a plain text file in which an organization states how to report security vulnerabilities on its website. RFC 9116 defines the format. Researchers find a contact in a machine-readable form instead of guessing an address.

## How is a security.txt file set up?

The file belongs at `https://example.com/.well-known/security.txt`. The RFC allows `/security.txt` in the root as a legacy location, and if both exist, the `/.well-known/` file wins. It must be served over HTTPS as `text/plain` in UTF-8.

Two fields are required. `Contact` says how to report an issue (email, phone or web URI). `Expires` sets the date after which the data counts as stale, and the RFC recommends a value less than a year ahead. Optional fields are `Acknowledgments`, `Canonical`, `Encryption`, `Hiring`, `Policy` and `Preferred-Languages`. The RFC recommends signing the file with an OpenPGP cleartext signature.

According to the RFC, the file applies only to the host it was retrieved from, not to subdomains or parent domains. CISA likewise advises a file for each domain and subdomain.

## Example

```txt
Contact: mailto:security@example.com
Expires: 2027-06-30T23:59:00.000Z
Preferred-Languages: en, de
Canonical: https://example.com/.well-known/security.txt
```

## Common mistakes

- `Expires` lies in the past, so the contact data counts as stale.
- `Contact` or `Expires` is missing, although both are mandatory.
- The file is reachable only over HTTP.
- Only the main domain has a file, while subdomains have none.

## FAQ

**Is security.txt a ranking factor?**
No source in this entry says so. The file serves security reporting.

**Is security.txt mandatory?**
RFC 9116 defines a format and does not make the file compulsory. CISA recommends that organizations publish one.

## At a glance

- **Type:** text file for security contacts
- **Status:** RFC 9116 (informational, April 2022)
- **Location:** /.well-known/security.txt
- **Values:** required fields Contact and Expires
- **Docs:** [RFC 9116](https://www.rfc-editor.org/rfc/rfc9116)

Last checked: October 8, 2026

## Machine-readable site files compared

| File | Standard or proposal? | Location | Purpose | Who reads it (documented) |
|---|---|---|---|---|
| robots.txt | IETF standard: RFC 9309 (September 2022) | /robots.txt | tells crawlers which URLs they may fetch; per the RFC not a form of access authorization | Crawlers; Google's common crawlers always respect it for automatic crawls |
| llms.txt | Proposal (Jeremy Howard, 2024; version 2 from August 2026) | /llms.txt or in a subpath | Markdown overview linking to Markdown versions of pages, for AI agents | per the proposal mainly coding agents; Google Search ignores it, says Google; Lighthouse only checks the fetch |
| llms-full.txt | no specification; not part of the llms.txt proposal, a convention of individual vendors (e.g. Mintlify) | /llms-full.txt (Mintlify also serves /.well-known/llms-full.txt) | entire documentation as Markdown in one file | no reader documented; Google Search doesn't use such files, says Google |
| ai.txt | Individual IETF Internet-Draft (June 2026, expires 2026-12-14), not a standard; predecessor by Spawning (2023) | /.well-known/ai.txt (draft), /ai.txt (Spawning) | AI usage preferences (training, scraping, indexing, caching), licensing, attribution | no reader documented in primary sources; Google Search doesn't use 'AI text files', says Google |
| TDMRep (tdmrep.json) | W3C Community Group Final Report (2024-05-10), not a W3C standard | /.well-known/tdmrep.json, HTTP header tdm-reservation or HTML meta tag | machine-readable reservation of text and data mining rights (Art. 4 DSM Directive) | parties performing text and data mining (per the specification) |
| security.txt | RFC 9116 (April 2022, informational, not standards track) | /.well-known/security.txt | contact for reporting security vulnerabilities; required fields Contact and Expires | Security researchers |
| ads.txt | IAB Tech Lab specification, version 1.1 (August 2022) | /ads.txt on the root domain, subdomains as needed | declares the companies authorized to sell the site's ad inventory | advertising systems and buyers (ad system crawlers) |
| humans.txt | Initiative (humanstxt.org), no formal specification | /humans.txt next to robots.txt, optionally linked via rel="author" | names the people who contributed to the website | people who want to know who is behind the website |

Sources: [RFC 9309: Robots Exclusion Protocol](https://www.rfc-editor.org/rfc/rfc9309.html); [Google: Overview of Google crawlers and fetchers (last updated 2026-06-12)](https://developers.google.com/crawling/docs/crawlers-fetchers/overview-google-crawlers); [The /llms.txt file, v2 (llmstxt.org)](https://llmstxt.org/); [llmstxt.org: Changes (v2, August 2026)](https://llmstxt.org/changes.html); [Google Search Central: Optimizing for generative AI features (last updated 2026-07-10)](https://developers.google.com/search/docs/fundamentals/ai-optimization-guide); [Chrome for Developers: Lighthouse llms.txt audit (2026-05-05)](https://developer.chrome.com/docs/lighthouse/agentic-browsing/llms-txt); [Mintlify: llms.txt and llms-full.txt](https://www.mintlify.com/docs/ai/llmstxt); [IETF Internet-Draft draft-car-ai-txt-wellknown-00 (2026-06-12)](https://www.ietf.org/archive/id/draft-car-ai-txt-wellknown-00.html); [W3C TDMRep Community Group: TDM Reservation Protocol, Final Report 2024-05-10](https://www.w3.org/community/reports/tdmrep/CG-FINAL-tdmrep-20240510/); [RFC 9116: A File Format to Aid in Security Vulnerability Disclosure](https://www.rfc-editor.org/rfc/rfc9116.html); [IAB Tech Lab: ads.txt](https://iabtechlab.com/ads-txt/); [IAB Tech Lab: ads.txt Specification Version 1.1 (GitHub)](https://github.com/InteractiveAdvertisingBureau/Supply-Chain-Validation/blob/main/ads.txt%20v1.1.md); [humanstxt.org](https://humanstxt.org/). Last checked: October 8, 2026

## Related terms

- [robots.txt](https://seo-geo-glossary.com/en/glossary/robots-txt/index.md)
- [ads.txt](https://seo-geo-glossary.com/en/glossary/ads-txt/index.md)
- [humans.txt](https://seo-geo-glossary.com/en/glossary/humans-txt/index.md)
- [HTTPS](https://seo-geo-glossary.com/en/glossary/https/index.md)

## Sources

- [RFC 9116: A File Format to Aid in Security Vulnerability Disclosure – RFC Editor](https://www.rfc-editor.org/rfc/rfc9116)
- [security.txt: Proposed standard for defining security policies – securitytxt.org](https://securitytxt.org/)
- [security.txt: A Simple File with Big Value – CISA, 2023-12-20](https://www.cisa.gov/news-events/news/securitytxt-simple-file-big-value)
- [Security.txt – Wikipedia](https://en.wikipedia.org/wiki/Security.txt)

---

Last updated: October 8, 2026
URL: https://seo-geo-glossary.com/en/glossary/security-txt/