Germany Urges Website Operators to Publish security.txt Files

Germany’s federal cybersecurity agency is calling on businesses, public bodies and website administrators to publish a security.txt file on their websites.

The Bundesamt für Sicherheit in der Informationstechnik, better known as BSI, says the simple measure can make responsible vulnerability reporting much faster. It also gives organisations less time to react before attackers discover and exploit the same weakness.

Despite the low implementation effort, the agency says only 1.8% of German website operators currently provide a security.txt file.

What a security.txt file does

A security.txt file is a standardised document placed on a website server. It gives security researchers, incident response teams and ethical hackers clear instructions for reporting a vulnerability.

Researchers often struggle to find the correct person or team to contact after identifying a security problem. They may have to search company websites, support portals and social media accounts before finding an appropriate address.

That delay can create real risk. A flaw may remain unreported or unresolved while cybercriminals look for ways to abuse it.

Publishing a dedicated file removes much of that uncertainty. It can include a security contact email address, a reporting policy, encryption details and other relevant information.

A simple path for reporting vulnerabilities

BSI said operators only need to provide contact details and an expiration date to start. The file must be available at:

/.well-known/security.txt

Once it is in place, researchers can quickly locate the organisation’s preferred reporting channel. Security teams can then investigate the issue and apply a fix sooner.

The approach helps companies, government bodies and other organisations handle reports in a more structured way. It also supports Computer Emergency Response Teams, known as CERTs, when they need to contact an affected organisation.

According to BSI, the small amount of work required can deliver meaningful security benefits.

Germany wants wider adoption

BSI and the Alliance for Cybersecurity are now encouraging webmasters, administrators and site owners across Germany to adopt the standard.

Wider use of the security.txt file could improve national cyber resilience by reducing the time between discovery and remediation. It may also make responsible disclosure easier for researchers who want to report problems safely.

Some EU countries have already taken a stronger approach. In the Netherlands, several public-sector bodies, including municipalities, provinces and water utility organisations, must use security.txt. Other public institutions receive recommendations to do the same.

Germany has not introduced a similar mandatory rule. However, BSI’s new appeal signals that the agency sees security.txt as a practical baseline measure for organisations that operate websites.