security.txt checker
Check that a website tells security researchers how to report a problem, with a valid, current security.txt file.
Choosing a check opens its page. With the keyboard, use the arrow keys, then press Enter.
What we check
We fetch https:// plus the site's host plus /.well-known/security.txt, the location RFC 9116 sets out. If it isn't there, we also try the older top-level /security.txt. We then check:
- How it is served: over HTTPS, as
text/plain; charset=utf-8, and any redirects, including to another host. - Contact: at least one, written as
mailto:,tel:or anhttps://address. - Expires: exactly once, a valid date in the future, and ideally less than a year ahead.
- Other fields: Policy, Encryption, Acknowledgments, Preferred-Languages, Canonical and Hiring, and whether the address we read matches a Canonical line.
- Signature: whether the file is signed with OpenPGP. We read the signed text but don't verify the signature.
A simple security.txt
Contact: mailto:security@example.com
Expires: 2027-06-30T23:00:00Z
Preferred-Languages: en
Canonical: https://example.com/.well-known/security.txt
Policy: https://example.com/security-policySave it as plain text at /.well-known/security.txt, and put a reminder in your calendar to move Expires forward before it passes.
We read up to 32 KB of the file. Addresses in it are shown as text, not links, because the file comes from another website.
Frequently asked questions
What is security.txt?
A small text file (RFC 9116) that tells people who find a security problem on your site how to report it: who to contact, and until when the file is valid. It lives at /.well-known/security.txt.
Which fields are required?
At least one Contact (an email address as mailto:, a phone number as tel:, or an https:// web page) and exactly one Expires date. Policy, Encryption, Acknowledgments, Preferred-Languages, Canonical and Hiring are optional.
What date should Expires have?
A date in the future, written like 2026-12-31T23:59:59Z. RFC 9116 recommends less than a year ahead, so the file is reviewed regularly. After that date, readers should treat the file as out of date.
Is the signature checked?
No. We spot a file signed with OpenPGP and read the signed text, but we don't check the signature. Check it yourself with the organisation's published key before you rely on it.
Why aren't the addresses clickable?
The file comes from another website, so its addresses are shown as text only. Copy one if you want to use it, after checking it belongs to the organisation.
Guides about this tool
-
Website
security.txt explained: how to publish one
What a security.txt file is for, the Contact and Expires fields it needs, where to put it on your website and the mistakes that make researchers ignore it.
Related tools
-
Security Header Checker
Check which browser security headers a website sends (HSTS, CSP, X-Content-Type-Options, Referrer-Policy and Permissions-Policy) and what they do.
-
SSL Certificate Checker
Check whether a site's HTTPS certificate is valid and trusted, which names it covers, and when it expires.
-
Robots.txt Checker
See a site's robots.txt rules for each crawler, spot mistakes, and test whether a page may be crawled.
-
Website Health Check
Run the main website, DNS and email checks on one site at once and get a short report, area by area, with links to the full results.