text/plain; charset=utf-8. Put a reminder in your calendar to refresh it before : researchers treat an expired file as stale. To sign it, run gpg --clearsign security.txt and publish the contents of security.txt.asc as the file. Check it once it's live.About the security.txt Checker & Generator
security.txt (RFC 9116) is a small text file that tells security researchers how to report a vulnerability: who to contact, in which languages, under which policy and until when the information is valid. It lives at /.well-known/security.txt on your site.
The checker fetches https://<domain>/.well-known/security.txt, falling back to the legacy /security.txt, and validates it. It requires at least one Contact (a mailto:, https: or tel: URI) and exactly one Expires date in RFC 3339 format that isn't in the past, and warns when that date is more than a year ahead. It checks that the file is served over HTTPS as text/plain; charset=utf-8, that a Canonical URL matches where the file was found, that Encryption, Acknowledgments, Policy and Hiring are proper URIs, and that Preferred-Languages holds language tags. It detects an OpenPGP cleartext signature but doesn't verify it.
The generator on the same page writes a valid file in your browser, with the Expires date filled in.
How to use it
- Enter a domain and select Check security.txt.
- Fix anything marked Fail, then the warnings.
- To create a file, fill in the generator, then download it and upload it to
/.well-known/security.txt.
Examples
- Check google.com: a published file with several fields.
- Check github.com: another large site's file.
- Check example.com: a domain with no file.
Common questions
Why does Expires matter?
An expired file may list contacts that no longer work, so researchers are told to treat it as stale. Set a date under a year ahead and update the file before then.
Should I sign the file?
It's optional. A signature lets researchers confirm the file is yours; add Canonical so a signed copy can't be reused on another site.
Related tools
- Security Headers Checker: grade the security headers of your site.
- SSL Certificate Checker: check the certificate the file is served with.
- Email Deliverability Checker: make sure your security contact address can receive mail.