Is been an RFC for almost a decade, RFC5785 [0].

Mattias Geniar has a good write up on it [1].

[0] https://tools.ietf.org/html/rfc5785

[1] https://ma.ttias.be/well-known-directory-webservers-aka-rfc-...

Neither seems to explain why these files aren't just placed in root, like robots.txt. What's the point of having a subpath?

The RFC says:

> 2. Why /.well-known? It's short, descriptive, and according to search indices, not widely used.

This gives reasoning for the name of the subpath, but not its existence.

To minimize collisions, and so we're not retreading this argument in another ten years: https://news.ycombinator.com/item?id=19063727

Ok, yeah. It occurs to me that websites might want the whole path to be variable text, maybe user defined.

This would also answer the question I've had for so long as to why Wikipedia chose to have /wiki/ before article titles in their URLs. I guess it was so that the article https://en.wikipedia.org/wiki/robots.txt did not collide with their robots.txt file.

Would've been nice if that explanation were included in the RFC.

Interesting. I guess I've been out of the web dev scene for a little over a decade now, so that makes sense.

.well-known is also used for ACME for auto-certificate generation and renewal.

I still would like to know the backstory around this folder, just like OP.

It's a standard directory with an RFC and all[1] and is widely used for a whole bunch of things, not just LetsEncrypt (such as WebDav).

[1]: https://tools.ietf.org/html/rfc5785

FYI .htaccess shouldn't generally be publically readable, as it's for your webserver, not the public. It's also only relevant to the directory it's in, hence why it's not in a separate directory.

Why are dotfiles generally considered "hidden" and not to be served (such as .htaccess, .env, etc) but .well-known is expressly intended to be served? It should have just been named well-known, IMO.

Because that made it unlikely to collide with existing / claimable uses. Consider https://github.com/well-known or https://instagram.com/well-known .

nginx is your friend.

I was working on a shared hosting environment (EIG) and saw this newly created directory (well-known) and promptly freaked. I viewed that dir and inside was "acme-challenge" and I freaked even more, thinking my client had been hacked. Was very happy to see this was not a hack, but found the naming conventions very odd.

Used by the Let's Encrypt client to verify site ownership.

I know that now ;-) but it was about 5 minutes of panic until I found my answer on Google.

It's used for a number of other things, from proof of control for cert issuers to information for OIDC. One of its main advantages is that it's self-describing. That is, it's a well-known place to put this sort of metadata about a site.

Auth0 also uses a "/.well-known/" URL path prefix as the default location for public keys.