Missing security txt
Quick winCreate and publish a /.well-known/security.txt file with at least a Contact: line so security researchers know how to report vulnerabilities responsibly.
What it is
A security.txt file is a small, plain-text file you place at a standardised web address on your store (/.well-known/security.txt). It tells security researchers — people who discover bugs or vulnerabilities in websites — exactly how to contact you to report the problem privately, before a bad actor can exploit it. Think of it as a "if you find something broken, call this number" sign on your front door. The format is an internet standard (RFC 9116) championed by the security community and recognised by platforms like Google and HackerOne.
Why it matters
Without a security.txt, a well-meaning researcher who finds a vulnerability in your store has no obvious, trusted way to reach you — so they may give up, publish it publicly, or disclose it to the wrong party, leaving your customers' data exposed. OWASP lists Security Misconfiguration (A05:2021) as one of the most common causes of breaches, and missing disclosure channels fall squarely in that category. Regulators and payment-card standards (PCI-DSS) increasingly expect documented vulnerability-disclosure processes; having a security.txt demonstrates basic security hygiene and can reduce your legal exposure if an incident occurs. It costs almost nothing to add and can prevent a damaging public breach disclosure.
How to fix it
- Go to securitytxt.org and use the generator form to build your file — enter at least one Contact: value (an email address like security@yourdomain.com or a web form URL) and an Expires: date (set it 12 months out and renew annually).
- Optionally add extra fields: Policy: (link to your vulnerability-disclosure policy page), Preferred-Languages:, Acknowledgments: (a thank-you page for reporters), and Encryption: (link to your PGP public key).
- Save the output as a plain-text file named security.txt (no extension beyond .txt, UTF-8 encoded, Unix line endings).
- Upload or publish the file so it is accessible at https://yourdomain.com/.well-known/security.txt — this requires placing it inside a folder called .well-known at the root of your web server or store.
- Verify it works by visiting https://yourdomain.com/.well-known/security.txt in your browser and confirming the plain text is returned with a 200 HTTP status.
- Set a calendar reminder to update the Expires: date before it lapses — an expired security.txt is treated as absent by automated tools.
Fix it on your platform
Pick your platform for the exact steps.
How to fix missing security txt on Shopify
- Shopify does not allow arbitrary files to be placed at /.well-known/ via the file manager for live storefronts.
- The recommended workaround is to use a Shopify app that serves a custom route, OR to handle it at the CDN/proxy layer (e.g. Cloudflare Worker or an edge redirect) that sits in front of your store.
- Alternatively, if you use a custom domain proxied through Cloudflare: in your Cloudflare dashboard go to Workers & Pages → Create Worker, paste the worker script (see code snippets) that returns your security.txt content for requests to /.well-known/security.txt, then add a Worker Route for yourdomain.com/.well-known/security.txt.
- Verify by visiting https://yourdomain.com/.well-known/security.txt in a browser.
How to fix missing security txt on Shopify Plus
- Same limitation as standard Shopify — the /.well-known/ path cannot be served directly from Shopify's asset pipeline.
- Use a Cloudflare Worker (see Shopify steps above) or ask your agency to handle this at the reverse-proxy layer.
- Verify by visiting https://yourdomain.com/.well-known/security.txt in a browser.
How to fix missing security txt on WooCommerce
- In your WordPress file manager (cPanel File Manager, SFTP, or a plugin like WP File Manager), navigate to the root of your site (the folder containing wp-config.php).
- Create a folder named .well-known if it does not already exist.
- Inside .well-known, upload or create a plain-text file named security.txt containing your contact details (see code snippets).
- Confirm the file is served by visiting https://yourdomain.com/.well-known/security.txt — WordPress should pass through static files without needing any rewrite rules.
- If you get a 404, add a rewrite rule to your .htaccess (Apache) or nginx config to ensure /.well-known/ is served as a static directory.
How to fix missing security txt on WordPress.org
- Connect via SFTP or use cPanel File Manager and navigate to your site's document root (the folder containing wp-config.php).
- Create a .well-known directory if absent, then create security.txt inside it.
- Paste your security.txt content (see code snippets) and save.
- Visit https://yourdomain.com/.well-known/security.txt to confirm a 200 response.
How to fix missing security txt on BigCommerce
- BigCommerce does not provide direct filesystem access to serve arbitrary files at /.well-known/.
- The best approach is to place a reverse proxy (e.g. Cloudflare) in front of your BigCommerce store and use a Cloudflare Worker to serve the security.txt content for requests matching /.well-known/security.txt (see Shopify Cloudflare Worker steps and code snippet).
- Alternatively, contact BigCommerce support to ask about serving static files at custom paths — available options vary by plan.
- Verify by visiting https://yourdomain.com/.well-known/security.txt.
How to fix missing security txt on Adobe Commerce (Magento)
- Connect to your server via SFTP/SSH and navigate to the Magento document root (the pub/ folder for Magento 2, or root for Magento 1).
- Create the directory .well-known inside pub/ (Magento 2) or the web root.
- Create the file security.txt inside .well-known with your contact details (see code snippets).
- Ensure your web server (Apache/Nginx) does not block .well-known — add a location block if needed (see code snippets).
- Verify by visiting https://yourdomain.com/.well-known/security.txt.
How to fix missing security txt on Magento Open Source
- Same as Adobe Commerce: place security.txt in pub/.well-known/security.txt via SFTP.
- Confirm your Nginx or Apache config allows serving that path (see code snippets for Nginx location block).
- Verify by visiting https://yourdomain.com/.well-known/security.txt.
How to fix missing security txt on Wix
- Wix does not allow custom files to be served at arbitrary paths like /.well-known/ from the standard editor.
- Use Wix's built-in HTTP Functions (Velo by Wix) to create a serverless function that responds to GET requests on the path /_functions/security_txt and returns your security.txt content — then set up a 301 redirect from /.well-known/security.txt to that function URL using Wix's 301 Redirects tool (Settings → SEO → 301 Redirects).
- Alternatively, if you manage DNS via Cloudflare, use a Cloudflare Worker to intercept and respond to /.well-known/security.txt requests before they reach Wix (see Shopify Cloudflare Worker steps).
- Verify by visiting https://yourdomain.com/.well-known/security.txt.
How to fix missing security txt on Squarespace
- Squarespace does not allow files to be placed at /.well-known/ directly.
- Use a Cloudflare Worker (if your domain is proxied through Cloudflare) to serve the security.txt content at that path before the request reaches Squarespace.
- Alternatively, contact Squarespace support to enquire about custom file hosting for /.well-known/ — this is not natively supported as of 2024.
- Verify by visiting https://yourdomain.com/.well-known/security.txt after configuring the worker.
How to fix missing security txt on Webflow
- In your Webflow project, go to Project Settings → Hosting → Advanced Publishing Settings.
- Webflow does not natively support placing arbitrary files at /.well-known/. Use a Cloudflare Worker in front of your Webflow site to intercept requests to /.well-known/security.txt and return the file contents.
- Create a Worker script (see code snippets), then add a Worker Route in Cloudflare for yourdomain.com/.well-known/security.txt.
- Verify by visiting https://yourdomain.com/.well-known/security.txt.
How to fix missing security txt on Headless / Custom (I build in code)
- Create the file at <webroot>/.well-known/security.txt on your server (or as a static asset in your framework's public directory).
- Ensure your web server or framework serves it with Content-Type: text/plain and does not block dotfile directories.
- For Next.js: place security.txt in /public/.well-known/security.txt — Next.js serves everything in /public as static files.
- For Nuxt.js: place security.txt in /public/.well-known/security.txt.
- Verify by visiting https://yourdomain.com/.well-known/security.txt.
How to fix missing security txt on PrestaShop
- Connect via SFTP to your PrestaShop root directory.
- Create a .well-known folder at the root if it does not exist, then create security.txt inside it.
- Verify Apache or Nginx does not block .well-known — add an allow rule if necessary.
- Visit https://yourdomain.com/.well-known/security.txt to confirm a 200 response.
How to fix missing security txt on OpenCart
- Connect via SFTP to your OpenCart root directory.
- Create .well-known/ at the root, add security.txt inside it.
- Ensure your .htaccess does not deny access to .well-known.
- Visit https://yourdomain.com/.well-known/security.txt to confirm it loads.
Does your site have this issue?
Run a free SEOLZ scan to find missing security txt — and every other issue — across your whole site in minutes.
Scan my site freeFrequently asked questions
What is Missing security txt?
A security.txt file is a small, plain-text file you place at a standardised web address on your store (/.well-known/security.txt). It tells security researchers — people who discover bugs or vulnerabilities in websites — exactly how to contact you to report the problem privately, before a bad actor can exploit it. Think of it as a "if you find something broken, call this number" sign on your front door. The format is an internet standard (RFC 9116) championed by the security community and recognised by platforms like Google and HackerOne.
Why does missing security txt matter?
Without a security.txt, a well-meaning researcher who finds a vulnerability in your store has no obvious, trusted way to reach you — so they may give up, publish it publicly, or disclose it to the wrong party, leaving your customers' data exposed. OWASP lists Security Misconfiguration (A05:2021) as one of the most common causes of breaches, and missing disclosure channels fall squarely in that category. Regulators and payment-card standards (PCI-DSS) increasingly expect documented vulnerability-disclosure processes; having a security.txt demonstrates basic security hygiene and can reduce your legal exposure if an incident occurs. It costs almost nothing to add and can prevent a damaging public breach disclosure.
How do I fix missing security txt?
Create and publish a /.well-known/security.txt file with at least a Contact: line so security researchers know how to report vulnerabilities responsibly.
Authoritative references
- OWASP Top Ten — OWASP
- OWASP Cheat Sheet Series — OWASP