My security scanner says security.txt is missing
Some security scanners, including the Security Insights page in Cloudflare, check
whether a website has a security.txt file. It is a small text file at a fixed
address on a site, /.well-known/security.txt, that tells a security researcher who to
contact if they find a problem.
The prompt
“My security scanner says [my web address] has no security.txt file. Check what bernard serves at that address and tell me whether I need to do anything.”
Signed in, Get my prompt fills in your site for you. Otherwise press Copy and fill in the [bracketed] parts. First time? Connect your AI to bernard once: Use your own AI (opens in a new tab).
bernard adds it for you
Every site bernard hosts has one. You do not make it, approve it or publish it. It is there on your bernard address and on your own domain, and it stays there when your site is private or switched off, so a researcher can always find the contact.
The file points reports to bernard, because bernard runs the hosting and can act on
them. It also names the address it lives at on your site, so a scanner can see it is the
real file. If an old link asks for /security.txt at the top of your site, it is sent on
to the right address.
bernard’s file always wins. If your site has its own file at that address, visitors and scanners get bernard’s file and not yours.
When a scanner still says it is missing
You do not need to change anything on your site. The scanner usually tested an address that does not reach bernard.
A common example: your site lives at the www version of your domain, and the plain version without www is sent on to it by your own domain settings. Some scanners stop at that first step, so they report the file as missing.
Run the scanner again on the address your visitors land on. It should find the file. If you are not sure which address that is, ask Bernard to check your domain. Bernard tells you which addresses reach your site and sorts out anything that needs it.
Scanners often also report missing security headers. bernard adds those too: see My security scanner says my site is missing security headers. For more about how bernard keeps your site safe, see Is it safe to let an AI edit my site?.
Questions people ask
- Do I need to make a security.txt file myself?
- No. bernard adds it to every site it hosts, on every address that points at your site, including a private site and a site that is switched off. There is nothing to write, nothing to approve and nothing to publish.
- What does the file say?
- It names bernard’s contact address for security reports, the language to write in, the date the file runs out, the address the file lives at on your site, and bernard’s terms for reporting abuse. Reports go to bernard because bernard runs the hosting and can act on them.
- Can I use my own security.txt instead?
- No. bernard’s file always wins, even if your site has its own file at that address. That keeps one place for reports about the hosting, which only bernard can fix.
- My scanner still says it is missing. What now?
- You do not need to change anything. The scanner usually tested an address that is sent on to your site before it reaches bernard, such as the plain version of your domain without www. Run the scanner on the address your visitors land on, or ask Bernard to check it for you.