Of the 158 files that exist

Valid today	60	38.0%
No `Expires` field at all	92	58.2%
Expired	6	3.8%

98 of 158 — 62.0% — are not valid files under the specification they are written to. The commonest failure is not an expired date but no date at all: the field was never added, and nothing ever asked for it.

Who publishes one in the first place

Sites that answered	332	66.4%
Publish a security.txt	158	47.6%
Never answered	168	33.6%

The 168 that never answered are counted here and nowhere else. A ranking of the most visited domains is full of content-delivery and API hostnames that serve nothing at their root; calling those "sites without a security.txt" would be a made-up number.

And the rest of what sites publish at their root

`robots.txt` what crawlers may read	233	70.2%
`security.txt` where to report a hole	158	47.6%
`assetlinks.json` Android app links	138	41.6%
`apple-app-site-association` iOS universal links	127	38.3%
`change-password` where a password manager sends you	77	23.2%
`llms.txt` what an AI assistant should read	70	21.1%
`gpc.json` Global Privacy Control	21	6.3%
`openid-configuration` OIDC discovery	19	5.7%
`mta-sts.txt` mail transport security	6	1.8%
`ai.txt` what AI crawlers may use	4	1.2%
`ucp` Universal Commerce Protocol profile	4	1.2%
`dnt-policy.txt` Do Not Track policy	4	1.2%

How it was measured

Population. The Tranco top 500, taken as it is — no filtering by kind of site.
Measurement. One HTTPS GET per file, four at a time for a single domain, one domain at a time, with a pause and a user agent naming the tool. Both locations RFC 9116 allows are checked.
Date. 2026-09-18.
Tool. well-known-audit — open source, zero runtime dependencies, tests on recorded responses.
Checked by hand before publishing. Four of the flagged sites were confirmed with curl, because a number like this is only worth having if it is right.
Repeat it. well-known-audit --batch survey/domains-top500.txt --csv out.csv rebuilds every table above.

What this does not say

An invalid security.txt does not mean a site is insecure. It means the one document a researcher reads first cannot be relied on.
This was run from one machine. A site that serves different files by region, or blocks an unknown user agent, is counted as unverified rather than guessed at.
No site is named on this page. The per-domain results are in the repository for anyone who wants to check their own.

Want to know what your own domains publish? npx well-known-audit yourdomain.com once it is released, or write to hello@dkautomation.dev.