llms.txt Overtook security.txt in Under a Year and Is Now on 4.9 Times as Many Top Websites, but the Top 1,000 Still Favor security.txt

Summary

Picture an IT manager with a checklist of files every company site should have: robots.txt, a sitemap, and security.txt so researchers can report vulnerabilities. This year the marketing team asks to add llms.txt. Which one do websites actually adopt first?

security.txt is an official internet standard (RFC 9116) published in 2022. It sits at /.well-known/security.txt and lists who to contact about security issues. llms.txt is an informal proposal from 2024 with no standards body behind it. Both are small text files at fixed addresses, which makes them a fair comparison.

The newer, informal file has already won on numbers. llms.txt is on 4.9 times as many top homepages as security.txt. Much of that comes from platforms switching llms.txt on by default. The most visited sites still lean the other way.

What we measured

We used the HTTP Archive mobile crawl in BigQuery (httparchive.crawl.pages) for top-1M homepages, October 2026, plus six earlier crawls from July 2025. A site has security.txt when HTTP Archive parsed at least one Contact field from /.well-known/security.txt. That rule screens out servers that return a web page at that address. A site has llms.txt when /llms.txt returned 200 with a text/plain or text/markdown content type.

We also compared newer AI-era files from the October crawl: the UCP commerce profile, and the agent discovery files (agent card, ai-catalog.json, ard.json).

llms.txt passed security.txt in about six months

Homepages with each file, by crawl.

security.txt is flat at roughly 2.6% to 2.9% of homepages. llms.txt climbed in every crawl and jumped in mid-2026 when a large store platform turned it on.

The top 1,000 still prefer the security standard

October 2026, share of homepages with each file by rank. UCP and agent files are included as newer AI-era files.

The lines cross around rank 1,000 to 5,000. Above it, security teams' file wins; below it, AI files win, largely because hosted platforms add llms.txt and UCP profiles for small stores.

The two files rarely sit on the same site

Overlap between the two files, October 2026.

Sites with security.txt are more than twice as likely as average to have llms.txt (33.7% vs 14.3%), so sites that publish one file are more likely to publish the other. But most llms.txt sites do not have the security file.

What this means

If you are adding llms.txt, take ten more minutes and add security.txt too. It is an official standard, it helps anyone who finds a problem on your site reach you, and it signals a maintained site. Neither file is a ranking factor. Be cautious with any AI SEO agency that sells either one as a shortcut.

The fast spread of llms.txt shows how quickly AI-related files catch on, often through platform defaults rather than owner choice. Check what your platform publishes in your name. Neither file decides whether AI assistants quote you; a free AI SEO audit from our team checks the things that do.

Limits

security.txt counts require a parsed Contact field, which excludes empty or malformed files; HTML pages at that address are excluded the same way.

llms.txt counts rely on status and content type; contents are not checked.

The top-1M sample changes between crawls.

Neither file's presence shows how well a site handles security or AI visibility.

Frequently asked questions

Related studies

• llms.txt and AI instruction filesllms.txt Adoption 2026: 14.3% of Top Sites Have One
• llms.txt and AI instruction filesllms.txt Grew From 1.1% to 14.3% of Top Sites in 15 Months
• llms.txt and AI instruction files15.6% of Top Sites Say 'Found' for Pages That Don't Exist
• llms.txt and AI instruction files46% of llms.txt Files Are Added Automatically by Platforms