Readiness check · Harden lane · weight 4

security.txt published

/.well-known/security.txt returns a plain-text file with a Contact field.

Observed on: 7.1%
Top 1K sites: 21%
Top 1M band: 5.1%
Not measured: 7,838

Why it matters

Security researchers look for this file to report problems privately. Without it, reports may go to a general inbox or never arrive.

How to fix it

Publish /.well-known/security.txt with at least Contact and Expires fields, as RFC 9116 requires, and review it before it expires.

How we check

/.well-known/security.txt returns a plain-text file with a Contact field.

Observed: security.txt with a contact found.

Not observed: No valid security.txt found.

Limit: Only the standard location was requested, once, at the time of the check.

Stack-specific steps

Cloudflare: Cloudflare Security Center can serve a security.txt file for the zone.

By popularity band

Chrome UX Report band	Observed	Measured
Top 1K	21%	414
Top 5K	13%	1,611
Top 10K	10%	1,951
Top 50K	7.1%	14,719
Top 100K	5.8%	4,280
Top 500K	5.5%	4,429
Top 1M	5.1%	4,853

Categories most likely to do this

Categories least likely

By stack

Astro20%
Nuxt on Amazon CloudFront20%
Adobe Experience Manager16%
Next.js on Vercel14%
Adobe Experience Manager on Amazon CloudFront14%
Sitecore14%
Next.js on Cloudflare13%
Next.js on Fastly12%
Nuxt on Cloudflare12%
Webflow11%
Nuxt11%
Next.js on Akamai10%
Next.js on Google edge10%
Next.js10%
Drupal on Cloudflare9.3%
Drupal8.4%
Next.js on Amazon CloudFront8.3%
Angular7.4%
Magento / Adobe Commerce6.8%
WordPress on Amazon CloudFront6.3%
PrestaShop6%
WordPress on Cloudflare3.3%
WordPress2.9%
Blogger1.3%
Shopify<1%

By provider

Popular sites where we observed this

Sources and guides

Guide: A Practical Website Health Check for Owners Check your own site