Verifying Your Domain with a File Upload

Overview

File upload verification proves domain ownership by placing a text file on your web server. This method is ideal if you have direct access to your website's hosting or can deploy files to your web root.

Step 1: Get Your Verification Token

After adding a domain in Dashboard → Settings, you'll receive a verification token — a short alphanumeric string like a1b2c3d4e5f6. This is the same token used for DNS verification.

Step 2: Create the Verification File

1. Create a new plain text file named exactly: verusight-verify.txt
2. The file content must be only your verification token — nothing else. No HTML tags, no extra text, no blank lines.

Example file content:

a1b2c3d4e5f6

3. Upload this file to the root directory of your website, so it's accessible at:

https://yourdomain.com/verusight-verify.txt

Step 3: Confirm the File Is Accessible

Before clicking verify in Verusight, test it yourself:

1. Open a browser and visit https://yourdomain.com/verusight-verify.txt
2. You should see only your token displayed as plain text
3. The page must load over HTTPS — HTTP-only sites will fail verification

Common hosting locations for the file:

• Apache/Nginx: Place in your web root (often /var/www/html/ or /public_html/)
• Static sites: Place in your build output/public directory
• CDN/Cloud storage: Upload to the root of your bucket or distribution

Step 4: Click "Verify File" in Verusight

Return to the Settings page and click the "Verify File" button. Verusight will:

1. Resolve your domain's IP address
2. Verify the IP is not a private/internal address (SSRF protection)
3. Fetch https://yourdomain.com/verusight-verify.txt with a 5-second timeout
4. Compare the file content against your verification token

If the content matches, your domain is immediately verified.

Security Protections

Verusight enforces several security measures during file verification:

• SSRF prevention: Before fetching the file, the system resolves your domain's IP and rejects private IP ranges (127.x, 10.x, 192.168.x, 172.16-31.x, IPv6 loopback/link-local). This prevents abuse against internal services.
• Timeout: The fetch request has a 5-second timeout. If your server doesn't respond in time, verification fails.
• User-Agent: Requests use the header Verusight-DomainVerifier/1.0 — make sure your server or WAF doesn't block this.

Troubleshooting

Error	Cause	Solution
"File not accessible (HTTP 404)"	File not found at the expected path	Ensure the file is at the exact path /verusight-verify.txt in your web root
"File content doesn't match"	Extra whitespace, HTML, or wrong token	The file must contain only the token — no extra characters or lines
"Request timed out"	Server is slow or blocking automated requests	Ensure your server responds within 5 seconds over HTTPS
"Domain resolves to a private IP address"	Your domain points to a local/internal IP	The domain must resolve to a public IP address
"Too many attempts"	Rate limit reached (15/5min)	Wait 5 minutes before trying again

After Verification

You can remove the verusight-verify.txt file from your server after verification is complete — it's no longer needed.

Related Articles

• DNS TXT Verification — alternative method using DNS records
• Verification Troubleshooting — comprehensive troubleshooting guide