Add a security.txt to your forum in 10 minutes
If someone finds a hole in your forum (an outdated plugin, an exposed backup, an XSS bug in a custom template), how do they tell you? Many researchers look for a file called security.txt. It's a tiny, standardized text file, and adding one takes minutes.
- Put the file at /.well-known/security.txt and serve it over HTTPS as text/plain (UTF-8).
- Contact and Expires are the only required fields; keep Expires less than a year out.
- Optional fields add a disclosure policy, preferred languages, encryption key and a canonical URL.
Where it goes
Under RFC 9116, A File Format to Aid in Security Vulnerability Disclosure, web services "MUST place the 'security.txt' file under the '/.well-known/' path," for example https://example.com/.well-known/security.txt. A copy at the top level (/security.txt) or a redirect is allowed for legacy compatibility, but if both exist, the /.well-known/ one wins. The file must be fetched over https and served with a Content-Type of text/plain in UTF-8. It applies only to the domain it's on, so a forum on a subdomain needs its own.
The required fields
- Contact (required; can appear more than once, in order of preference): an email as a
mailto:URI, a phone astel:, or an https web page. - Expires (required, exactly once): the date after which the file is stale, in RFC 3339 format. The RFC recommends it be "less than a year into the future."
Useful optional fields
- Policy: link to your vulnerability disclosure policy.
- Preferred-Languages: for example
en. If missing, researchers may assume English. - Canonical: the URL(s) where the file lives (recommended if you sign it).
- Encryption: a link to your PGP key, recommended when Contact is an email address.
- Acknowledgments and Hiring, if you have them.
Example for a small forum
Contact: mailto:security@yourforum.example Contact: https://yourforum.example/contact.html Expires: 2027-10-01T00:00:00Z Preferred-Languages: en Canonical: https://yourforum.example/.well-known/security.txt Policy: https://yourforum.example/security-policy.html
Setup checklist
- Create the
.well-knownfolder in your web root (some hosts already have one for SSL validation; see HTTPS with Let's Encrypt). - Upload
security.txtand open it in a browser to check it loads over HTTPS as plain text. - Use an address you actually read, and set a calendar reminder before Expires.
- Write a short policy page: what's in scope, how fast you'll reply, and a promise not to take legal action against good-faith reports.
- When a report comes in, thank the reporter, fix it, update your software and review admin security.
Published October 29, 2026. We do not use affiliate links on this page; see our Affiliate Disclosure.