How to fix missing security txt on Wix

Steps for Wix

1. Wix does not allow custom files to be served at arbitrary paths like /.well-known/ from the standard editor.
2. Use Wix's built-in HTTP Functions (Velo by Wix) to create a serverless function that responds to GET requests on the path /_functions/security_txt and returns your security.txt content — then set up a 301 redirect from /.well-known/security.txt to that function URL using Wix's 301 Redirects tool (Settings → SEO → 301 Redirects).
3. Alternatively, if you manage DNS via Cloudflare, use a Cloudflare Worker to intercept and respond to /.well-known/security.txt requests before they reach Wix (see Shopify Cloudflare Worker steps).
4. Verify by visiting https://yourdomain.com/.well-known/security.txt.

What is missing security txt?

A security.txt file is a small, plain-text file you place at a standardised web address on your store (/.well-known/security.txt). It tells security researchers — people who discover bugs or vulnerabilities in websites — exactly how to contact you to report the problem privately, before a bad actor can exploit it. Think of it as a "if you find something broken, call this number" sign on your front door. The format is an internet standard (RFC 9116) championed by the security community and recognised by platforms like Google and HackerOne.

Without a security.txt, a well-meaning researcher who finds a vulnerability in your store has no obvious, trusted way to reach you — so they may give up, publish it publicly, or disclose it to the wrong party, leaving your customers' data exposed. OWASP lists Security Misconfiguration (A05:2021) as one of the most common causes of breaches, and missing disclosure channels fall squarely in that category. Regulators and payment-card standards (PCI-DSS) increasingly expect documented vulnerability-disclosure processes; having a security.txt demonstrates basic security hygiene and can reduce your legal exposure if an incident occurs. It costs almost nothing to add and can prevent a damaging public breach disclosure.

See the complete Missing security txt guide for every platform and the full background.