How to add a security.txt file
Short answer: create a plain-text file at /.well-known/security.txt with at least a Contact: line (an email or web form) and an Expires: date less than a year ahead. Serve it over HTTPS. It tells people who find a security problem on your site how to reach you.
Quick steps
- Write the file. Add Contact and Expires, plus optional Preferred-Languages, Canonical and Policy lines.
- Publish it. Place it at /.well-known/security.txt on your HTTPS site.
- Check it. Fetch it with curl and confirm it is plain text.
- Renew it. Update the Expires date before it passes.
1. Write the file
Contact: mailto:security@yourdomain.com
Expires: 2027-10-31T00:00:00Z
Preferred-Languages: en
Canonical: https://yourdomain.com/.well-known/security.txt
Policy: https://yourdomain.com/securityContactandExpiresare required. You can list several Contact lines.Expiresuses the ISO 8601 date format. RFC 9116 recommends less than a year ahead.Policylinks to your responsible-disclosure page, if you have one.
2. Publish it
Upload it to .well-known/security.txt inside your web root (create the .well-known folder if needed). On WordPress, upload it with your host’s file manager or SFTP. With nginx you can also point to a file elsewhere:
location = /.well-known/security.txt {
alias /etc/nginx/security.txt;
default_type text/plain;
}3. Check it
curl -si https://yourdomain.com/.well-known/security.txt | head -n 12You should see status 200 and Content-Type: text/plain. Here is HackGrade’s own security.txt as an example.
4. Keep it valid
An expired file should be treated as stale, so set a calendar reminder a month before the Expires date. Use a shared mailbox for Contact rather than a personal address.
Frequently asked questions
Is security.txt required by law?
No. It is a voluntary standard (RFC 9116), but it makes it far more likely that a problem is reported to you rather than published.
Will security.txt attract attackers?
No. It only contains contact details. Use a shared address, not a personal one.
Should I also put a copy at /security.txt?
The standard location is /.well-known/security.txt. A redirect from /security.txt is optional.