security.txt Adoption 2026: 2.3% of Federal Domains Have a Valid File, 3.9% of Big Companies

security.txt adoption is still rare where it matters most. On 11 November 2026 we requested /.well-known/security.txt from 4,155 domains. Only 2.3% of answering federal executive .gov domains and 3.9% of the 500 largest US companies served a file that passes RFC 9116, and 46% of federal files had expired.

Adoption by population: who publishes a security.txt

A security.txt file tells a researcher who found a flaw where to report it. RFC 9116 needs only two lines, a Contact and an Expires date. We counted a domain as having a file when /.well-known/security.txt (or the legacy /security.txt) returned an HTTP 200 plain-text body with at least one Contact field. A file is valid when it is at the /.well-known/ path over HTTPS, is served as text/plain, has exactly one Expires line written in RFC 3339 date format, and that date had not passed on the day we fetched it.

Share of domains that answered an HTTPS request. Domains whose robots.txt disallowed the path were excluded (117 in total, 67 of them in the top 1,000).

Distinct files counts each final URL once: 46 federal domains with a file resolve to 34 distinct files, because agencies park many alias domains that redirect to one main site.

The ranking is the reverse of what the directives would suggest. The most visited consumer sites lead, with 16.0% serving a file. Big companies follow at 9.9%. Federal executive .gov domains, where civilian agencies have been required to publish a vulnerability disclosure policy since 2021, sit at 5.3%, and state domains at 2.4%. In 2022, Hexiosec found a file on 18 of 490 S&P 500 sites (3.6%); the large-company figure has risen since, though the populations are not identical.

How these numbers compare with other security.txt studies

Published adoption rates differ mostly because of the population. Whole-internet scans count millions of parked and small domains, which drives the rate toward zero; lists of prominent organizations sit far higher.

Other studies’ figures as published on their own pages (see References); their methods and validity rules differ from ours.

RFC 9116 field completeness matrix

Among the files that exist, quality varies more by publisher than by field. Contact and Expires are the only required fields. The matrix shows how often each field appears in the files found for each group.

Share of security.txt files found in each population that contain the field. “Expires not passed” requires a parseable date later than the fetch time. The last row checks the Content-Type header, which RFC 9116 says must be text/plain with charset=utf-8.

Federal files are the most likely to carry a Policy link (67%), and 28 of them point to the /vulnerability-disclosure-policy page that BOD 20-01 requires. Preferred-Languages appears in 37% of federal files against 68% of the 22 state files, and an Acknowledgments page (a public thank-you list for researchers) in 9% of federal files against 36% on the top websites. Signatures are rare everywhere: 14 of 256 files are OpenPGP signed.

Expired security.txt files: the date nobody renews

RFC 9116 asks for an Expires date less than a year out so that abandoned files go stale. That works only if someone renews them. 50 of the 256 files we found (20%) had already expired, and 62 had no Expires line at all.

Expires date relative to the moment each file was fetched, 2026-11-11 to 2026-11-11. Percentages are of files found in each population.

The federal problem is concentration. 21 of 46 federal files had expired, and many of them are the same file reached through different alias domains. Counting distinct files, 13 expired federal files sit behind those 21 domains. Another 12 federal files set Expires more than a year ahead, which RFC 9116 recommends against.

Federal agencies: a mandatory policy, an optional file

Binding Operational Directive 20-01, issued on September 2, 2020, required every federal civilian executive agency to add a security contact for each .gov domain at the registrar within 30 days and to publish a vulnerability disclosure policy within 180 days. It mentions security.txt only as an aid: “While use is not required under the directive, it can help some people find who to share vulnerability findings with.” The gap shows in the data.

Registrar security contact: share of all 1,173 federal executive domains in CISA’s dotgov-data file with a non-blank security contact field. security.txt shares are of the 873 domains that answered HTTPS. Agencies: the 121 organizations named in the registry.

Federal executive organizations with a valid file on at least one domain at scan time (8):

• Department of Agriculture
• Department of Commerce
• Department of Energy
• Department of Homeland Security
• Department of State
• Department of the Interior
• Executive Office of the President
• General Services Administration

Counting agencies rather than domains changes the picture only a little: 8 of 121 organizations (7%) have a valid file anywhere, and 14 (12%) have any file. Many agency domains redirect to a main site, and a researcher who lands on one of them reaches the main site’s file through the redirect, which RFC 9116 allows. Our counts include files reached that way: 13 of the 46 federal files were served after a redirect to a different domain. Each entry in CISA’s Known Exploited Vulnerabilities catalog carries a federal due date, and our CISA KEV analysis tracks those additions; next to that workload, renewing one dated contact file a year is a small task.

State government .gov domains by state

We checked every domain CISA lists as “State or territory” (1,488 domains). 2.4% of the 911 that answered serve any security.txt, and 10 are valid. Per-state counts, alphabetical by postal code:

Aggregates only. We do not publish which individual state domains lack a file.

The 500 largest US companies, by sector

The corporate list is the 500 largest US-located SEC registrants with a listed ticker, ranked by calendar 2025 revenue in SEC XBRL data, which yields a list close to the Fortune 500 (the smallest company in it reported about $7.2 billion). Each company’s domain is the website named in its latest 10-K. 46 of the 465 that answered serve a file and 18 pass every check.

Large companies that publish a valid security.txt, in revenue order: Apple Inc., Microsoft Corporation, Johnson & Johnson, Procter & Gamble Co, IBM, The TJX Companies, Inc., Cisco Systems, Inc., Intel Corporation, General Electric Company, SLB Limited, Booking Holdings Inc., Marriott International Inc, Adobe Inc., Texas Instruments Inc, Wayfair Inc., Airbnb, Inc., Owens Corning, First Citizens Bancshares Inc.

Public companies now describe their cyber risk process in 10-K Item 1C cybersecurity disclosures and report material incidents in 8-K Item 1.05 filings, yet most give an outside researcher no machine-readable way to reach the security team.

The most common security.txt mistakes

Counts of files found in each population. A further 549 domains answered /.well-known/security.txt with HTTP 200 but returned an HTML page (usually the homepage), which a scanner can mistake for a file. We did not count those as files.

Who receives the reports: 48 files route to HackerOne, 19 to Bugcrowd, 13 to Intigriti and 2 to ResponsibleDisclosure. Across all four groups, 63% of files list at least one contact on a domain other than the one serving the file.

What this means for MSPs and IT teams

A security.txt file takes ten minutes to write and fails silently a year later. For each client domain: publish the file at /.well-known/security.txt, point Contact at a monitored shared mailbox or a reporting form rather than one person, add a Policy link, and set Expires 11 months out with a ticket to renew a month before. Add a check to your monitoring that fetches the file and alerts 30 days before Expires; 20% of the files in this study would have triggered it. For public sector clients, the BOD 20-01 vulnerability disclosure policy page is the natural Policy target, and the registrar security contact should match the Contact line. The same discipline applies to email: our DMARC adoption statistics show how often a published record exists but is set to do nothing.

Frequently asked questions

How many websites have a security.txt file?

In our 2026 scan, 142 of the 888 most visited websites that answered (Chrome UX Report top 1,000 origins) served a security.txt file with a Contact field, 16.0%, and 82 (9.2%) passed every RFC 9116 check we ran. Across all web domains the rate is far lower: a 2026 scan of 241 million gTLD domains by IoTDef found 0.238%.

Is security.txt required for federal agencies?

No. CISA’s Binding Operational Directive 20-01 (September 2, 2020) requires a vulnerability disclosure policy at /vulnerability-disclosure-policy and a security contact for every .gov domain, and states that security.txt use is not required. In our scan 5.3% of answering federal executive .gov domains served a file, while 91% of all 1,173 have a registrar security contact on file.

What happens when a security.txt file expires?

RFC 9116 says the contents of a file past its Expires date are considered stale and should not be used. 50 of the 256 files we found (20%) had already expired, including 46% of federal files.

Where should security.txt be located?

At https://yourdomain/.well-known/security.txt, served over HTTPS as text/plain with charset=utf-8. The top-level /security.txt is a legacy location; if both exist, the /.well-known/ file must be used. 33 of the domains we checked had a file only at the legacy path.

Is security.txt an official standard?

It is RFC 9116, published by the IETF in April 2022 in the Informational category. It is not on the Internet Standards Track, even though many guides call it a proposed standard.

Which fields are required in security.txt?

Only Contact (one or more) and Expires (exactly once). Everything else is optional. Policy appeared in 62% of the files we found and an OpenPGP signature in 5%.

Free to cite and republish with a link. The CSV holds the aggregate counts behind every chart and table: populations, federal agencies, corporate sectors and states in the first block, then field completeness and common mistakes by population. It does not contain per-domain results.

Methodology

References

1. IETF, RFC 9116: A File Format to Aid in Security Vulnerability Disclosure (April 2022). Accessed November 2026.
2. CISA, Binding Operational Directive 20-01: Develop and Publish a Vulnerability Disclosure Policy. Accessed November 2026.
3. CISA, dotgov-data: current-full.csv. Accessed November 2026.
4. SEC, EDGAR APIs: XBRL frames, submissions and company_tickers.json. Accessed November 2026.
5. Google, Chrome UX Report methodology and CC BY 4.0 licence, via zakird/crux-top-lists. Accessed November 2026.
6. CISA, Known Exploited Vulnerabilities Catalog. Accessed November 2026.
7. CISA, security.txt: A Simple File with Big Value (December 20, 2023). Accessed November 2026.
8. Hexiosec, 1 Million Websites: How Many Use Security.txt? (October 26, 2022). Accessed November 2026.
9. URIports, Follow-Up on Security.txt Adoption: Progress and Pitfalls (January 2025). Accessed November 2026.
10. IoTDef, The State of Security.txt Adoption: An Analysis of 240 Million Domains in 2026. Accessed November 2026.