News
ads.txt vs app-ads.txt on Public Marketing Origins
February 4, 2022
ads.txt vs app-ads.txt on public marketing origins is two IAB Tech Lab files that list who may sell your ad inventory. ads.txt lives at https://example.com/ads.txt for the website. app-ads.txt lives on the developer domain you declare in the app store, often /app-ads.txt, for in-app ads. Both are supposed to be public and fetchable without cookies. They are not a WAF, not security.txt, and not access control. A missing file is normal if you do not sell ads. A file that pastes origin IPs, private reseller passwords, or a CMS version résumé is the miss. RoastMyOpsec does not score ads.txt or app-ads.txt and does not verify ad-tech authorization.
The practical difference
ads.txt authorizes sellers for the web origin. app-ads.txt authorizes sellers for the mobile app, published on a domain you control. The web app manifest and assetlinks.json are other public catalogs with different jobs. security.txt is researcher contact — do not put Contact only inside ads.txt.
Third-party ad tags are a script blast radius. The text file does not replace CSP, SRI, or first-party analytics. See trackers vs first-party analytics.
How to choose what to publish
You sell display ads on this host: keep ads.txt accurate, HTTPS, no redirects that break crawlers, no secrets. You ship an app with ads: publish app-ads.txt on the developer domain the store listing names. You sell nothing: omit both; a 404 is healthy. Do not copy a competitor's file. Do not list internal SSP hostnames that skip the CDN.
| File | Job | Public origin | Takeaway |
|---|---|---|---|
| /ads.txt | Web authorized sellers | Yes, if you sell ads | Inventory list, not a lock |
| /app-ads.txt | App authorized sellers | On the developer domain | Same class; different product |
| security.txt | Vulnerability contact | If you will read reports | Different well-known job |
| Web app manifest | PWA metadata | If you install | See manifest vs public metadata |
When ads.txt still wins
It wins when you actually sell ads and want buyers to check authorization. It never wins as a substitute for header hygiene. Missing ads.txt on a brochure site is not a roast F.
What the roast can prove
Neither file is scored. Tracker-shaped hosts in HTML can still surface. Confirm ads.txt in your own browser. Pair with humans.txt if the same origin over-shares staff names in another text file.
Common mistakes
The first mistake is putting a shared ad-network password in a comment at the bottom of ads.txt.
The second mistake is treating a 200 on ads.txt as proof the tag manager is safe.
The third mistake is requiring ads.txt on a site that does not sell ads.
Free audit the URL you own
RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.
Free audit nowFAQ
- Is a missing ads.txt a vulnerability?
- No. If you do not sell ads, omit the file. If you do sell ads, a missing or stale file is a business/ads-txt compliance miss, not a roast F.
- Can ads.txt replace security.txt?
- No. Different parsers, different jobs. Researcher contact belongs in RFC 9116.
- Does RoastMyOpsec fetch ads.txt?
- Not as a scored path. It may still pattern-match known ad and analytics hosts in HTML.