How to Add a security.txt File to Your Website in 5 Minutes (With a Generator)

Source: Dev.to

If you’re running a website in 2026, you probably care about security.
You might have HTTPS, HSTS, CSP, maybe even a bug‑bounty program.
But there’s a tiny text file most sites still miss:

/.well-known/security.txt

It’s a simple file that tells security researchers how to contact you if they find vulnerabilities on your site.

What is security.txt?

security.txt is a proposed standard (RFC 9116) for publishing security contact information for your website.
It works like robots.txt:

The file normally lives at:

https://example.com/.well-known/security.txt

Inside, you list things like:

• Who to contact (email or URL)
• A link to your security policy
• Optional: your PGP key, acknowledgments page, hiring info, etc.

When someone finds a bug, they can go to that URL and follow the instructions instead of guessing where to report it.

Why it matters

• Many security issues go unreported because there’s no clear place to send them.

• A security.txt file says: “If you find something, here’s exactly how to tell us.”

• Even a small SaaS, indie project, or side project looks more mature with a simple line like:

  Policy: https://example.com/security-policy
  Contact: mailto:security@example.com

• It’s just a small text file, served over HTTPS, updated occasionally—one of those “10 minutes now, potential lifesaver later” tasks.

Fields you can include

The standard defines several fields. You don’t need all of them; the most common are:

You can also add comments with #:

# Security contact for Example Corp
Contact: mailto:security@example.com
Policy: https://example.com/security-policy
Expires: 2027-01-01T00:00:00Z

That’s it—just a structured text file.

Creating security.txt manually

1. Read the RFC (or a blog post) to understand the syntax.
2. Decide which fields you need.
3. Copy/paste examples and adjust them for your site.
4. Ensure the Expires date is a valid future timestamp.
5. Save the file as security.txt, place it in /.well-known/, deploy, and test.

Using a generator

Several online generators exist. One example is the CodersTool security.txt generator:

1. Open the generator in your browser.
2. Fill in the key fields (Contact, Policy, Expires, optional fields).
3. Click Generate.
4. Copy the output or download the file.
5. Save it as security.txt and deploy it to /.well-known/.

The generated snippet looks like:

# security.txt for Example SaaS
Contact: mailto:security@example.com
Policy: https://example.com/security-policy
Acknowledgments: https://example.com/security-acknowledgments
Expires: 2027-01-01T00:00:00Z
Canonical: https://example.com/.well-known/security.txt

No login, no project setup, no CLI required.

Deploying security.txt on various platforms

The goal is always the same: serve the file from

https://yourdomain.com/.well-known/security.txt

How you get it there depends on your stack.

Static sites (HTML/CSS/JS)

Create a .well-known folder at the root of your site:

/your-site-root/
  index.html
  …
  /.well-known/
    security.txt

Upload the folder as you normally would and test:

https://yourdomain.com/.well-known/security.txt

Static site generators (Hugo, Jekyll, etc.)

Add .well-known/security.txt to your static or public folder so it ends up in the final build output.

Laravel / PHP

Option A – Static file

/public/
  index.php
  …
  /.well-known/
    security.txt

Laravel will let the web server serve the file directly.

Option B – Dynamic route (if you prefer generating it on the fly)

// routes/web.php
Route::get('/.well-known/security.txt', function () {
    return response(file_get_contents(public_path('.well-known/security.txt')))
        ->header('Content-Type', 'text/plain');
});

.NET / IIS

1. In the site’s root folder, create a .well-known directory.
2. Drop security.txt into it.
3. Ensure IIS is allowed to serve .txt files (default configuration usually permits this).

/wwwroot/
  web.config
  …
  /.well-known/
    security.txt

ASP.NET Core (Kestrel + reverse proxy)

• Place .well-known/security.txt into wwwroot, or
• Map a route that returns the text file.

CDN / Cloudflare / Fastly

• Make sure the origin serves /.well-known/security.txt.
• Verify the CDN isn’t blocking or rewriting that path.
• If the CDN offers its own security.txt feature, decide whether to use it or let the origin file pass through.

Verify deployment

1. Open a browser and navigate to https://yourdomain.com/.well-known/security.txt.

2. You should see the plain‑text content you created.

3. Optionally, use a tool like curl:

   curl -I https://yourdomain.com/.well-known/security.txt

   Check that the response status is 200 OK and the Content-Type is text/plain.

Once verified, you’re done—your site now provides a clear, standardized way for security researchers to contact you.