Well-known URIs

What /.well-known/ is

RFC 8615 reserves one path on every website. Anything under /.well-known/ is a place where a protocol can put a file at a location that is the same on every host, so a client knows where to look without being told. It is how a certificate authority proves you control a domain, how a browser finds your password-change page, and how a phone links an app to a website.

That makes it a shared global namespace carved out of every domain on the internet, which is why it has a registry rather than being a free-for-all. There are 101 registered paths. Most lists of them are a dozen entries long and undated; this is all of them, with the three columns the registry has and copies usually drop.

The most interesting of those columns is the change controller, because only 36 of the 101 are controlled by the IETF. The rest belong to individual companies and consortia — 54 distinct organisations in all. When you serve a file under /.well-known/, the rules for most of those paths were written by whoever asked for them.

How to use this list

1. Search by path, controller or specification. The box matches all three, so you can look up acme-challenge, or find everything W3C controls, or everything defined by a particular RFC.
2. Filter by status. Permanent, provisional, deprecated and obsoleted are four different things, and a copied list that shows them as one row type is hiding the difference.
3. Read the deployment table underneath. It shows the same probe counted two ways, and the gap between the columns is the point.

A 200 response does not mean the file is there

Checking whether a site serves a given well-known path looks trivial: request it and see whether you get a 200. That method is close to useless, and the measurement here shows by how much.

Probing 120 domains, of which 89 answered, the status code alone says host-meta is served by 28.1% of them. Requiring a plausible content type as well says 0.0%. Not one of those domains serves a host-meta document. They serve a single-page application whose catch-all route answers 200 with an HTML shell for any path you ask for, including paths nobody has ever registered.

The overstatement is not uniform, which is what makes it dangerous. For paths that are genuinely common it is mild — assetlinks.json goes from 61.8% to 44.9%, security.txt from 64.0% to 42.7%. For the rest it is catastrophic: change-password drops from 37.1% to 1.1%, and mta-sts.txt and nodeinfo do the same. A tool that reports the first column is telling you a site supports things it has never heard of.

What exposed it was not a failing check but a suspicious pattern: host-meta and nodeinfo scored identically, at exactly 25 hits each. Two unrelated protocols cannot have the same adoption, so the number was measuring the probe rather than the web. Any existence check over HTTP needs a content type, a body shape, or a control path known to be absent.

One caveat stated plainly: 89 domains is a demonstration, not a census, and much larger scans of these paths exist. The distance between the two columns is the finding; the absolute figures are illustrative.

What the registry does not tell you

The registry records what was registered, which is not the same as what the web serves. The clearest example is in the deployment table: apple-app-site-association is served by roughly a third of the domains sampled, making it the third most-deployed path measured here, and it does not appear in the registry at all. Google registered its equivalent, assetlinks.json; Apple did not register theirs. Both are on millions of sites.

Status is not a proxy for adoption either. change-password is still only provisional despite being implemented by every major browser and password manager, while plenty of permanent entries are served by almost nobody. The four states describe how firmly a path is reserved, not how much it is used.

There is one entry that has been hollowed out. Five paths are deprecated or obsoleted, and one of them, mud, has had both its reference and its change controller removed, leaving a registered name pointing at nothing. It is kept in the list rather than filtered, because a registry admitting it no longer knows who owns something is more informative than a tidy table.

On accuracy: the IANA page carries two tables, the registry and a separate contact table for change controllers, and scraping rows without distinguishing them yields 146 entries for a registry of 101. The generator here identifies the registry by its header row, and the test suite re-derives every figure on this page from the source HTML rather than from the generated file, across 971 assertions with 14 negative controls.

Why is it free?

This is a table rendered in your browser. There is no server doing work, so there is nothing to charge for and no account to create.

Nothing is fetched on your behalf either. A browser cannot request another site's /.well-known/ paths, so this page does not pretend to check your domain — it tells you what exists and what the numbers really mean, and your browser's developer tools or a command line will do the rest.