Well-Known Security Files Explained

The /.well-known/ path, standardised in RFC 8615, is a reserved location on every domain meant for exactly this purpose: a predictable place for automated tools and services to find specific, well defined information about a site without needing to guess or be told where to look. Several genuinely useful conventions live there, and security.txt and change-password are two of the more practical ones for an ordinary website.

A file at /.well-known/security.txt, defined in RFC 9116, gives a security researcher who finds a vulnerability a clear, standard place to find out who to contact and how, rather than trying to guess an email address or dig through a contact page not meant for this purpose. It requires at minimum a Contact field and an Expires date, and can optionally include a link to a formal disclosure policy, an encryption key, and more.

A URL at /.well-known/change-password lets a password manager or browser send a user directly to the correct account settings page the moment it flags a password as weak, reused, or exposed in a breach, rather than leaving the user to hunt through account settings themselves. It typically redirects to wherever the site's real password change page actually lives.

Neither convention is old or widely adopted yet, so not finding either one on a given site is common rather than a red flag on its own. They're most valuable to implement on a site that handles real user accounts or wants a clear channel for responsible vulnerability disclosure, and relatively low effort to add once decided on.

Security.txt Checker looks for a security.txt file at the standard location, falling back to the older root path, and validates its required fields. Change-Password URL Checker confirms whether the change-password convention resolves to a real page. Run both after implementing either one to confirm it's actually being served the way it's meant to be.