No valid security.txt

SeverityInfo

ScopeWhole site

EffortSmall

Verified bySecurity scan (weekly, or Re-scan)

Rule keysec_securitytxt

Short answer

Publish a plain-text file at /.well-known/security.txt with at least a Contact: line and an Expires: date in the future (RFC 9116). It takes a few minutes and tells researchers where to report a problem instead of guessing or posting it publicly.

Why it matters

When someone notices a vulnerability on your site, such as an exposed file or a broken login check, they need a reliable way to tell you. Without one, reports end up in a general inbox nobody reads, in a public post, or nowhere. security.txt is the standard place where researchers and automated reporting tools look first.

The risk of not having it is indirect, which is why this is an informational check. It has no effect on search rankings.

How Glimana detects it

Glimana requests /.well-known/security.txt and, if that does not return 200, the older location /security.txt, following up to two redirects. A response that is not 200 or is served as HTML (for example a CMS error page) counts as missing and is reported as info. If a file is found but has no Contact: line, no readable Expires: date, or an Expires: date in the past, the problem is low. Other fields and signatures are not checked.

How to fix it

Watch out

Expires is required, and once that date passes the file is treated as invalid again. RFC 9116 recommends a date less than a year ahead, so set a reminder to renew it. Some security hardening rules block every path that starts with a dot (for example RedirectMatch 403 /\..*$), which also blocks /.well-known/.

Find the finding in Glimana. Open Security; this check is in the Information leaks group, with the evidence from the last scan under its title. The same problem is listed under Issues › No valid security.txt.
Apply the fix on your platform.
Any serverWordPressNginx
Create a UTF-8 text file named security.txt:
- Contact: mailto:security@example.com
- Expires: 2027-10-31T23:00:00.000Z
- Preferred-Languages: en, tr
- Canonical: https://example.com/.well-known/security.txt
Upload it to a .well-known folder in the web root (the folder may already exist for certificate validation). Use an address that is monitored; an https:// contact form is also allowed.
WordPress does not create this file. Upload security.txt with your host's file manager or SFTP into .well-known/ next to wp-config.php. Open the address in a browser: you should see the plain text, not a themed 404 page.

Serve the file explicitly as text: location = /.well-known/security.txt { default_type text/plain; alias /etc/nginx/security.txt; }, then nginx -t && systemctl reload nginx. Make sure no earlier location ~ /\. rule denies it.
Check it in Glimana. Press Re-scan on the Security page (up to two scans an hour) or wait for the weekly scan on Sunday; the problem closes when the check passes.

How the fix is verified

After the fix, press Re-scan on the Security page (or wait for the weekly Sunday 04:00 scan); the problem closes when the check passes.