Rfc 9116 was published in 2022 and details a standard which allows websites to define security policies. It's somewhat similar to RFC 9309 which defines the usage of the robots.txt file.
A security.txt file should be placed at
https://www.example.com/.well-known/security.txt or https://example.com/security.txt
Key fields defined in the spec
| Field | Required? | Purpose |
|---|---|---|
Contact: | ✅ Yes | Email, URL, or phone for reporting |
Expires: | ✅ Yes | When the file should be considered stale |
Encryption: | Optional | PGP key for encrypted reports |
Acknowledgments: | Optional | URL of a hall of fame / thanks page |
Preferred-Languages: | Optional | Languages the team works in |
Canonical: | Optional | Authoritative URL of this file |
Policy: | Optional | Link to your vulnerability disclosure policy |
Hiring: | Optional | Link to security-related job postings |
It advises security researchers on how to contact the organisation, who to contact and can contain some other related informaiton.
So how widely has security.txt been adopted in the .ie domain name space?
Sudo.ie scanned 187099 .ie domain names in March 2026.
Scanning all 187,099 .ie domains in March 2026, only 1,830 had a valid security.txt — less than 1%. For comparison, Pen Test Partners found under 2% for UK .gov.uk domains and around 6% for the Majestic Million top 10,000 websites globally. Ireland is broadly in line with the rest of the internet.
For context: 54% of the same domains have a robots.txt — that's 55 times more adoption. The gap illustrates how far security.txt has to go even to reach the baseline of an informal web standard.
What About the 99% of .ie domain names without a security.txt?
Of the 187,099 domains without a valid security.txt:
- 99,561 returned a clean 404 — the security.txt simply doesn't exist
- 67,993 had connection errors, 14,850 returned something else (typically a HTML page or redirect caught at the URL)
- 17,715 timed out
That last pair — 46% of failed scans — point to a significant portion of the .ie namespace that is either parked, expired, or pointing nowhere. Nearly 28% of all registered .ie domains were completely unreachable during the scan.
The Orderyoyo Effect
The most striking finding in the data isn't the 1% figure — it's what's hiding inside it.
991 of 1,830 security.txt (54%) all route to [email protected] — a food ordering platform that auto-generates a security.txt for every restaurant it hosts. These aren't organisations that have made a deliberate decision to adopt a vulnerability disclosure policy; they're takeaways that happen to have one.
Top contact domains across all .ie security.txt:
| Platform | Count | Notes |
|---|---|---|
| orderyoyo.com | 991 | Irish food ordering platform |
| webador.com | 270 | Dutch website builder |
| gmail.com | 35 | Personal email |
| nameweb.biz | 18 | Irish hosting provider |
| sage.com | 15 | Accounting software |
| vortala.com | 11 | SME website builder |
| nitrosell.com | 9 | Ecommerce platform |
Stripping out the platform-generated security.txts results in organisations that have consciously chosen to implement security.txt — is closer to ~570 domains, or about 0.3%.
This isn't a criticism of orderyoyo or webador for including it by default; that's actually good behaviour from a platform. But it does mean the headline 0.98% figure flatters real-world intent considerably.
What's Actually in .ie security.txt?
Of the 1,830 security.txt found:
| Field | Count | % |
|---|---|---|
| Contact | 1,830 | 100% |
| Preferred-Languages | 1,673 | 91.4% |
| Expires | 1,654 | 90.4% |
| Hiring | 339 | 18.5% |
| Policy | 179 | 9.8% |
| Canonical | 140 | 7.7% |
| Acknowledgments | 81 | 4.4% |
| Encryption | 66 | 3.6% |
| CSAF | 1 | 0.05% |
The high Preferred-Languages figure is somewhat misleading — 284 of those are en, nl, the default set by webador.com (a Dutch company), not a deliberate choice by the site owner.
Only 179 (9.8%) include a Policy link — the URL to a formal vulnerability disclosure policy. That's the field arguably most useful to a security researcher, and 90% of security.txt don't have it.
For contact method: 88.5% use mailto: and 11.5% use an HTTPS URL. No tel: contacts were found.
Are security.txt Being Maintained?
RFC 9116 requires an Expires field — the security.txt is considered stale after that date. Of the 1,830 security.txts discovered:
- 1,569 (85.7%) have a valid future expiry
- 176 (9.6%) have no
Expiresfield at all — technically non-compliant. - 85 (4.6%) have already expired.
One notable expired security.txt: rte.ie — Ireland's national broadcaster — has a security.txt that expired in June 2025. A researcher visiting today would find an out-of-date contact that the organisation may no longer monitor.
Irish Government: Only One Out of 74
There are 74 .gov.ie domains in the dataset. Only one has security.txt: ncsc.gov.ie — the National Cyber Security Centre, which is the government body responsible for promoting cybersecurity in Ireland.
Every other Irish government domain — HSE, Revenue, the various Departments — has no security.txt. If a researcher discovers a vulnerability in a government website, there's no standard channel to report it.
The irony that the NCSC is the only one to have implemented it is not lost.