Before juudd published a page telling people where to report a bad site, it made sure the address on that page could receive mail. The order is the decision: the mailbox exists before the page that names it. A page that points at an address which bounces is worse than no page at all.
The rest of this post is why a report needs somewhere to arrive, what the page promises and what it refuses to, and the file that tells a scanner where to look.
An operator had a lever and nobody could tell them to pull it
An operator can take any site off the air in one click, and the terms forbid unlawful content, malware, phishing and impersonation by name. What was missing was the other end. When we measured the public surface, there was nowhere for a report to land:
Path on juudd.com | Answer |
|---|---|
/abuse | 404 |
/.well-known/security.txt | 404 |
/security.txt | 404 |
| mail for the domain | no receiving records at all |
The only address anywhere was a person's mailbox at the bottom of two legal pages.
That is not a missing convenience. The people who send these reports look for a documented address: a bank's fraud desk, a browser vendor, a registrar, another host. When they do not find one, they escalate to the party above us. That party can act on the whole domain, not on one hostname, and every customer site is served from one. So with no address, every report went past the one party who could fix it in a click and landed on the one whose remedy is blunt.
Two addresses, ready before the page
The decision has four parts.
- The mailbox first. The domain could not receive mail, so
abuse@would have bounced every report. Receiving was switched on before the page was written. - Two addresses.
abuse@andsecurity@. A flaw in the platform and a bad site hosted on it come from different people and need different judgement. Splitting them costs one forwarding rule. Today both reach the same person. - A page, not a form. A form is a queue, and a queue implies somebody watching it.
- A generated
security.txt. It lists both contacts, says which languages we read, and points its policy field at the abuse page.
The file has a required expiry date, and a literal date in a file nobody visits is a promise to remember that always gets broken. So the date is computed at build time: one year out, rounded to the start of the day so a rebuild an hour later does not change it. Every deploy renews it. The file can only go stale if the site has not shipped for a year, and by then stale is the correct thing for it to say.
The page describes the remedy and promises no time
/abuse says what to send: the full URL, one sentence on what is wrong, when you saw it, and a screenshot if you have one. It says what we can do: stop serving the site. The site's code is removed from the network that serves it and the hostname stops answering. We do not delete anything, so every version stays stored.
It also says what we cannot do. We cannot act on a domain we do not serve, because we can detach it from the platform but we are not its registrar. We cannot tell you who owns a site, because sign-in identity is not ours to hand out. And we do not act on a site that is merely disagreeable.
What it does not say is how fast. There is one operator and no rota, and who is on the hook for a report is not settled. A page promising an answer within a day would write a commitment nobody has agreed to, on the surface where breaking it is most expensive. An address that answers late is recoverable. An address that publicly missed its own deadline is what a reporter forwards to a registrar.
So the page describes what happens instead: the address reaches a person, every act is written into the account's permanent record naming the operator who took it, and a wrong decision is undone in one act that restores the exact version that was live.
What we turned down
- Publishing the owner's personal address. It worked on the day and it is what the legal pages already carried. A role address is what an automated reporter looks for, and it survives a person changing jobs.
- A form. See above: it is a queue with nobody named.
- Waiting until we had decided who answers. The ordering is the uncomfortable one: reports can now arrive before anybody has agreed who answers them. The alternative was to keep routing them to the party above us, and an address answered slowly beats a remedy applied to the whole domain.
What this leaves open
An address with nobody behind it is worse than no address, because it turns "they could not be reached" into "they were told and nothing happened". Publishing the page makes that question live rather than answering it. Who watches the mailbox, and how fast, is still undecided. The page is in English only, following the other reference pages.
The rule, once
A place to report abuse has to work before it is announced: the mailbox first, the page second, and no promise on the page that nobody has agreed to keep. The tools and their limits are listed in the docs.