A security.txt file: telling researchers how to report a problem

The short answer: security.txt is a small text file, in an agreed place on your site, that tells whoever discovers a security flaw who to report it to. It is described in a public standard (RFC 9116). For a small site it is not mandatory, but it takes ten minutes and keeps a useful warning from having nowhere to go.

How to create it

1 Create an e-mail address just for this, such as security@your-domain.com. See How to create an e-mail account in cPanel. That way reports do not get lost in the inbox of someone who leaves the company.
2 In cPanel’s File Manager, in the public_html folder, create a folder called .well-known (with the dot in front), if it does not exist yet. Do not delete or touch what is already there; other services use this folder.
3 Inside it, create the file security.txt with this content, changing what is needed:
Contact: mailto:security@your-domain.com
Expires: 2027-10-15T00:00:00.000Z
Preferred-Languages: en, pt
Canonical: https://your-domain.com/.well-known/security.txt
4 Open the address https://your-domain.com/.well-known/security.txt in a browser and confirm the text shows.
Field What it is for
Contact Required. An e-mail (mailto:) or a web address where the flaw is reported.
Expires Required. The date after which the information can no longer be trusted. The standard recommends less than a year: pick a date and set a calendar reminder.
Preferred-Languages The languages you prefer to receive the report in.
Canonical The right address of the file itself.
Policy A link to your disclosure policy, if you have one.

What to expect

You will get a few useful reports and many automatic ones of little value: tools that point out things of no importance, and requests for payment for “findings”. Read them without hurry, do not answer threats and do not pay. If a report seems serious, open a support ticket with the message so we can look at it together.

Do not promise what you cannot deliver. Do not write that you pay rewards if you do not. And put someone in charge of the mailbox who actually reads it. For the rest of the site’s security, see Keeping your VPS secure and Security headers explained.
Want to report abuse coming from another site (spam, phishing)? That is something else: see Reporting abuse.

Need help creating the folder or the file? Open a ticket with the domain.

Open a support ticket

SEE ALSO

Reporting abuse: how to do it and what happens next

Security headers explained: what they do and how to add them in .htaccess

How to create an e-mail account in cPanel?

Personal data protection: what applies to your website

RECOMMENDED PRODUCT

Web hosting with cPanel

Domain and SSL included, daily backups and the panel you already know. from $6.60/mo (3-year plan, with coupon)

See plans
  • 0 Users Found This Useful
Was this answer helpful?

Related Articles

What is an SSL certificate and why does it matter? An SSL certificate encrypts the connection between a visitor's browser and your site, so passwords, card numbers and any...
Why does my SSL certificate show fewer than 365 days? If you're on the free SSL every account gets by default, this doesn't apply to you - skip to the note below. This is onl...
How to redirect HTTP to HTTPS with .htaccess This forces every visitor to the encrypted version of your site, even if they type or link to the plain http:// address....
How to tell if your site has been compromised Most infections don't announce themselves - they show up as small, odd symptoms before anything looks obviously wrong. S...
How to clean up a compromised site Cleaning up is only half the job - if the door that let the infection in stays open, it comes back. Work through this in...
Checking your site’s HTTPS setup: certificate, chain, expiry and protocols The short answer: the browser’s padlock does not tell the whole story. A site can show the padlock on your computer and...