Standard addresses

Recommended

• Serve standard files at fixed addresses

  Recommended

  Serve files under /.well-known/ at their exact paths, with the right content types and no sign-in. Open them to other sites where they are meant for agents.

• List your APIs in one file

  Recommended

  List your public APIs and machine-readable files at /.well-known/api-catalog, as an RFC 9727 linkset (a JSON list of links).

• Require encrypted mail delivery

  Recommended

  If the domain receives email, publish an MTA-STS policy, so other mail servers deliver to it only over checked TLS.

Optional

• Point to the change-password page

  Optional

  If people have accounts, redirect /.well-known/change-password to the page where they change their password.

• List the sites that share passkeys

  Optional

  If you accept passkeys across several of your domains, list the related origins in /.well-known/webauthn.

• Point to the passkey pages

  Optional

  If people can sign in with passkeys, publish /.well-known/passkey-endpoints with the pages where they add and manage them.

• Publish identity provider settings

  Optional

  If you are an OpenID identity provider, publish discovery data at /.well-known/openid-configuration.

• Publish OAuth server settings

  Optional

  If you run an OAuth authorisation server, publish its details at /.well-known/oauth-authorization-server.

• Explain how to get API access

  Optional

  If an API needs OAuth, describe how to get access at /.well-known/oauth-protected-resource.

• Say you honour privacy signals

  Optional

  If you honour Global Privacy Control, a browser signal that means "don't sell or share my data", say so in /.well-known/gpc.json.

• Answer account lookups

  Optional

  If you have accounts that others look up, answer /.well-known/webfinger queries.

• Open links in your iOS app

  Optional

  If you have an iOS app, publish /.well-known/apple-app-site-association so links open in it.

• Open links in your Android app

  Optional

  If you have an Android app, publish /.well-known/assetlinks.json so links open in it.

• Describe a federated server

  Optional

  If you run a federated server, such as a Mastodon-style social server, publish /.well-known/nodeinfo.

• Limit prefetch proxies only if needed

  Optional

  Publish /.well-known/traffic-advice only to limit private prefetch proxies, which load pages early for privacy browsers. Leaving it out welcomes them.