What is security.txt, and should your site have one?
A small text file that tells security researchers how to report a vulnerability to you. It is optional, it takes minutes, and its absence is one of the quietest ways a site signals that nobody is minding it.
What it actually is
It is a "who to call" note, published where the people who need it will look. Someone finds a flaw in your site — a researcher, a customer, a bored teenager — and their next question is who to tell. Without an answer they either give up, post it publicly, or contact whoever they can find, which is usually the wrong person. security.txt puts the answer in a standard place, in a standard format, so it is found rather than hunted for.
Why it matters
It is a trust and maturity signal, and it is read by more than researchers. Google, GitHub and Meta all publish one; so do most companies that take procurement seriously. If you sell to businesses, an absent security.txt is the kind of small thing that shows up in a security questionnaire and costs you an afternoon of explaining. More practically: the alternative to a reported vulnerability is an unreported one.
What good looks like
A file at yoursite.com/.well-known/security.txt carrying the two fields the standard (RFC 9116) actually requires: a contact route, and an expiry date that is still in the future. A file with a contact and no expiry is not valid, and an expired file is explicitly not to be trusted — the standard says so.
Being honest about it
This is a low-weight check and we score it that way. It will not move your rankings and it will not get you cited by an AI. It is hygiene, and it matters most if you sell to other businesses or handle anything sensitive. If you are a small local site, it is genuinely fine to have this one sit unfixed for a while.
Where most sites go wrong
The most common failure is not absence — it is the expiry date. A file gets published once, with a date a year out, and then nobody touches it again. The day it expires, the file becomes worse than nothing: the standard instructs researchers not to trust it, so you now have a published, ignored contact route. The second failure is a contact that no longer reaches anyone, which is the same problem wearing a different hat. Publishing this file is a small commitment to maintaining it.