Question 1

Why do so many top sites not have a security.txt file?

Accepted Answer

Many organizations still rely on generic contact pages or bug bounty platforms for vulnerability reports. While RFC 9116 was published in 2022, adoption is growing but far from universal. Some companies also handle disclosure through dedicated bug bounty platforms rather than a security.txt file.

Question 2

How are the top 500 sites determined?

Accepted Answer

The ranking is based on the Tranco list, a research oriented top sites ranking that combines data from multiple sources to produce a more stable and reliable list than any single provider. We filter out infrastructure domains so the index reflects only websites that people actually visit.

Question 3

How often is this index updated?

Accepted Answer

The index is scanned periodically to capture changes in security.txt adoption across all listed domains.

Question 4

What makes a valid security.txt file?

Accepted Answer

Per RFC 9116, a valid security.txt must include at least a Contact field and an Expires field with a future date. Optional fields include Encryption, Policy, Acknowledgments, Canonical, Hiring, and Preferred-Languages.

Question 5

Does having a security.txt file improve security?

Accepted Answer

A security.txt file doesn't directly improve security, but it significantly improves your ability to receive and respond to vulnerability reports.

Web Security Index