The web root became a junk drawer, and everyone wants a slot in it

The narrow problem well-known URIs were meant to solve

Mark Nottingham — who edited RFC 8615, the spec that defines /.well-known/ — wrote a guide for the steady stream of people who want to register a new one. His argument is narrow on purpose. A well-known URI earns its place only when a client already knows which site to ask, needs a fact that's true site-wide, and checking individual resources would be wasteful. robots.txt is the canonical fit: it predates the RFC and still exemplifies the pattern.

The rule he keeps returning to is a filter against overuse:

"If your protocol can use a real URL, don't bother with a well-known location."

Reserving a slot is not a badge, he stresses — IANA registration isn't a credential, and it shouldn't be sought as one.

The pitfalls he names by hand

Nottingham walks through the traps that trip up new proposals. Discovery is ambiguous when a site spans subdomains and an apex domain, or when redirects sit in the path. Shared-hosting and multi-publisher sites force a tradeoff between convenience and granularity, sometimes needing a parallel metadata mechanism. The pattern also quietly assumes a 1:1 relationship between a service and a site, which becomes rigid in deployment. And proposals should spell out which URL schemes apply rather than silently assuming HTTPS.

The thread: "it became the junk drawer of the web root"

The discussion agreed the namespace has sprawled past its brief.

".well-known started tidy and quietly became the junk drawer of the web root. security.txt, ACME, app-site-association, and counting." — a developer cataloguing what's accumulated there

The sharpest reframe set the whole thing in a longer pattern the web can't seem to escape:

"How do you associate metadata with a public name? A SRV record! No, a TXT record! No, a meta tag! No, an X.509 attribute! No, a random file at top level! No, a well known file under some schema!… It would be nice if we picked an extension mechanism and maximally enhanced it rather than having everyone invent his own." — a commenter on the web's habit of re-solving the same problem

Another voice argued the lesson is to stop spilling into the root entirely, pointing at llms.txt as a fresh offender that should have lived under .well-known/ if anywhere.

Does anyone actually fetch these?

The most grounded skepticism came from someone running real sites, who questioned whether a registered URI translates into actual use:

"Does a change-password registry actually get used, even by bots? I don't see bots checking for a .well-known/change-password url on my sites." — the founder of WakaTime, who runs developer-facing services

That's the quiet tension under the whole guide. A spot in the registry confers tidiness and a sense of legitimacy, but not adoption. The pattern's defenders in the thread saw the demand growing anyway: domain-anchored, autonomous discovery is exactly what agentic clients will lean on, which means more proposals are coming, junk drawer or not.