What is trust.txt, and what can a buyer learn from it?
Part of MFA avoidance
The short answer
trust.txt is a plain text file a publisher posts on its own domain to declare the associations it belongs to, the sites it owns or is owned by, its social accounts and its contacts. JournalList maintains the specification. Buyers treat it as claims to confirm, because a membership counts only when the association's file lists the publisher back.
Key takeaways
- trust.txt declares relationships, such as belongto, member, control and controlledby, not who may sell a site's ad space.
- A claimed membership is confirmed only when the association's own trust.txt lists the publisher in return.
- The specification says a file should not be treated as a signal of trust on its own, and a missing file is not a negative sign.
- No public census of trust.txt files with a stated method was found, so adoption cannot be given as a number.
- The control and controlledby lines help a buyer spot several sites on one plan that share an owner.
What is trust.txt?
Definition
- trust.txt
- A plain text file on a publisher's root domain that lists the organizations it belongs to, the domains it controls or is controlled by, its social accounts and its contacts, one declaration per line, in a format any crawler or person can read.
The file comes from JournalList, which calls itself "the caretaker of the trust.txt world" and describes a system that helps "the digital robots of the world know about groups that have formed to express some trust in each other." The trust.txt specification (opens in a new tab), version 1.5, was first published May 20, 2020 and approved in its updated form July 11, 2024. Its abstract says it standardizes a way "to systematically publish the connection between website Publishers and Associations those Publishers choose to make."
The design borrows from robots.txt and ads.txt: a small file the publisher fully controls, posted where machines know to look. The purpose is different. Where our ads.txt guide covers who is authorized to sell a site's inventory, trust.txt is about affiliation: the press association, the news cooperative, the parent company. The specification lists itself as a released draft, and JournalList says it may be updated or replaced, so check the version date before relying on a field.
What does a trust.txt file declare?
Each line takes the form variable=value. The specification makes no distinction in the file between publishers and associations, by design, since one organization can have members and be a member at once. All fields may repeat except controlledby and datatrainingallowed, which should appear once.
| Field | What the specification says it holds | Buyer use |
|---|---|---|
| belongto | An association or other organization the publisher belongs to, one line each | Open the association's file and look for a matching member line |
| member | A member of an association, one line each | Confirms a publisher's belongto claim from the other side |
| control | A domain directly controlled by one entity, for ownership groups | Lists sister sites that may already be on the plan |
| controlledby | The domain of the owner or controlling entity, listed once | Names the parent, to check against registry and about pages |
| social | A social media account directly controlled by the publisher | Separates official accounts from impersonators |
| vendor and customer | Suppliers and buyers of products or services | Context only; a vendor line is not an endorsement |
| disclosure | A link to a policy, such as an ethics policy | Leads straight to standards worth reading |
| contact | Contact details in any form | A route for questions before a deal |
| datatrainingallowed | yes or no on scraping for AI and other reuse | A publisher policy; it says nothing about ad quality |
Fictional example
A short trust.txt file for a fictional regional news site
A fictional site at example.com posts four lines: belongto=https://example.org/ for a state press association, controlledby=https://example.net/ for its parent company, social=https://www.youtube.com/@examplechannel for its video account, and contact=newsroom@example.com.
A buyer then opens example.org/.well-known/trust.txt and looks for member=https://example.com/, and opens example.net's file to look for control=https://example.com/. If both lines are there, the association and the ownership claims are confirmed from both sides.
How can buyers use trust.txt on a candidate site list?
The specification asks publishers to post the file on the root domain with a path or redirect at /.well-known/trust.txt, served as plain text, and says it applies to all subdomains. A missing file (an HTTP 404) means no declarations exist; a server error means the file is undefined. Redirects count only while they stay within the original root domain, up to three of them. The JournalList FAQ (opens in a new tab) explains the core test: when the referenced organization's file does not carry the matching entry, the claim's "credibility is questionable."
Read a publisher's trust.txt in five steps
- Open the file. Load the site's /.well-known/trust.txt, then /trust.txt, and note which answered and the date checked.
- List the claims. Copy each belongto, controlledby and control line into the site's review notes.
- Confirm each claim from the other side. Open the association's or owner's own trust.txt and look for the matching member or control line.
- Compare owners across the plan. Sort the confirmed controlledby lines and flag sites that share a parent, so one group does not fill the list unnoticed.
- Check the social lines. Make sure each listed account links back to the site, which separates the publisher's own channels from copies.
How far has trust.txt been adopted?
No public count of trust.txt files with a published method was found when this page was checked in October 2026, so this page gives no adoption figure. What the primary sources do show is direction. In an April 10, 2024 post (opens in a new tab), JournalList announced that GFMD, an umbrella body for the media development community, and Impress, an English standards body for news outlets, had adopted the file, and wrote that "our membership had been largely based in the U.S."
The IPTC trust and credibility guidelines (opens in a new tab), revised May 8, 2025, recommend that "all news publishers investigate the trust.txt system" and decide whether to host a file. In February 2025 the Reynolds Journalism Institute (opens in a new tab), an early funder, reported a browser extension that detects the files and described the effort as "still working to build its following." For a US or Canadian plan, a site without a file is not a warning, as the specification itself says.
What can trust.txt not prove?
The specification is direct about its limits. Its scope section says it is not in its scope "to define, for example, what is 'truth' or to say who is or is not a journalist." Its note on reliability says the platforms and networks "must weigh for themselves the trustworthiness of any individual Publisher or Association."
the existence of a file on a site should not be regarded a priori as a signal of trust on its own. Also, the lack of a trust.txt file should not on its own be regarded as a negative indicator.
| Question | trust.txt answers it? | Where else to look |
|---|---|---|
| Does the site belong to this association? | Yes, when the association's file lists it back | The association's member page |
| Who owns the site? | Partly; controlledby is the publisher's own claim | Business registries, the site's about page |
| Are the articles accurate? | No | Corrections, sourcing and the newsroom's standards |
| Is the site built mainly to show ads? | No | Ad layout, traffic sources and content quality checks |
| Who may sell its ad space? | No | ads.txt and the exchanges' sellers.json files |
| Is its content suitable for a brand? | No | A suitability review of sampled articles |
An association is only as meaningful as its own entry rules. The specification's definition is loose on purpose: an association is "Any group of Publishers, as defined by that group," from state press associations to titles held by one owner. A confirmed belongto line tells the buyer which group vouches for the site, so the next step is to read that group's membership terms. Our news credibility checklist covers the on-site evidence that trust.txt does not.
What does a trust.txt review look like on a real brief?
Fictional example
A string instrument shop's classical music brief in Massachusetts and Connecticut
A fictional string instrument shop that sells and repairs violins and cellos asks its agency for a fall display plan in Massachusetts and Connecticut, around Boston, Worcester and Hartford, beside arts coverage, concert listings and music education. The planner has eighteen candidate sites after content review and checks each one's trust.txt.
Five sites carry a file. A Worcester arts weekly lists a belongto line for a regional press association, and the association's file lists it back, so the planner records the membership as confirmed. Two Boston culture sites both name the same controlledby parent, and the parent's file lists both under control. The planner keeps the stronger of the two on the core list and moves the other to a test line, so one owner does not take two places.
A Hartford music blog claims membership in a national association whose file does not include it. The planner notes the claim as unconfirmed rather than false and decides on the blog's articles alone. The thirteen sites with no file are reviewed the same way as before, with no mark against them.
How does PlacementGraph check who runs a site on a plan?
Frequently asked questions
Does trust.txt replace ads.txt?
No. The two files answer different questions. ads.txt lists the companies authorized to sell a site's ad space, while trust.txt lists the organizations a publisher belongs to, the domains it controls and its official accounts. A site can carry either, both or neither, and a buyer reads them separately.
Can a publisher that only posts video on YouTube have a trust.txt file?
The specification suggests it can. For a publisher that does not control a base URL, such as a video publisher working only on YouTube, it advises a single page website that links to the channel, with the trust.txt file posted on that site, so the channel can be listed under a social line.
What does datatrainingallowed mean for an advertiser?
Nothing about ad quality. The field is a publisher's directive to scrapers: yes allows collection without restriction, and no means a tool cannot collect data for uses other than referring readers back without a binding contract first. It records the publisher's policy on AI training, not its audience or editorial standards.
Should a buyer require trust.txt for a site to join a deal?
The specification itself says the lack of a file should not on its own be read as negative, and adoption across US and Canadian publishers has no published count. A requirement would remove sites for paperwork rather than evidence. Treat a confirmed file as useful context and judge each site on its content.
Sources
- Specification for trust.txt file and underlying system, version 1.5 (opens in a new tab)JournalList (first published May 20, 2020; updated version approved July 11, 2024)
- Frequently asked questions (opens in a new tab)JournalList
- JournalList and trust.txt (opens in a new tab)JournalList
- trust.txt goes global with GFMD and Impress (opens in a new tab)JournalList, April 10, 2024
- Guidelines for expressing trust and credibility signals in IPTC standards, version 1.1 (opens in a new tab)IPTC, revised May 8, 2025
- Trust.txt launches browser extension (opens in a new tab)Reynolds Journalism Institute, University of Missouri, February 21, 2025
Researched and written by PlacementGraph Research. Read how we research, source and update these pages. Corrections: diana@placementgraph.com.