security.txt Checker
Enter a website to find its security.txt file and check it against RFC 9116, so security researchers can reliably find out how to report vulnerabilities to you.
Overview
security.txt is a small text file, defined in RFC 9116, that tells security researchers how to report vulnerabilities in your site. It lives at /.well-known/security.txt and lists at least one Contact and an Expires date, plus optional links to your disclosure policy, encryption key, and acknowledgments page.
Small mistakes stop it from being useful: an expired date, an email address written without mailto:, a file served as an HTML page by a catch-all route, or a copy only at the legacy /security.txt path. This checker fetches the file the way researchers’ tools do and reports each of these problems.
It checks the file is served over HTTPS as text/plain, validates every Contact and the Expires timestamp, warns when Expires is more than a year away, checks the Canonical URL, and notes whether the file is PGP-signed.
Examples & Sample Data
Valid file
github.com
Pass: Found at /.well-known/security.txt, Contact https://hackerone.com/github, Expires within a year
Missing Expires
A file with only Contact lines
Problem: No Expires field. Expires is required by RFC 9116.
How It Works
- Enter a domain or any URL on the site.
- The checker requests https://domain/.well-known/security.txt, and /security.txt if that isn’t found or is an HTML page.
- It checks the response’s HTTPS, content type, and charset, then parses the fields, removing any PGP signature.
- Each field is validated against RFC 9116, and the parsed fields and raw file are shown below the findings.
Common Use Cases
Publishing a vulnerability disclosure contact
Validate a new security.txt file before announcing a disclosure policy or bug bounty.
Keeping the file current
Catch an Expires date that has passed, which tells researchers the contact details may be stale.
Compliance and security audits
Check security.txt across your sites as part of an external attack-surface review.
Tips & Best Practices
- Set Expires less than a year ahead and add a calendar reminder to update it.
- Write email contacts as mailto:[email protected]. A bare address isn’t a valid URI.
- Make sure your web server or framework serves the file as plain text, not through a single-page-app route that returns HTML.
Frequently Asked Questions
Contact, at least once, and Expires, exactly once. Policy, Encryption, Acknowledgments, Canonical, Preferred-Languages, and Hiring are optional.
At /.well-known/security.txt on each domain, served over HTTPS. A copy at /security.txt is allowed for legacy tools but shouldn’t be the only one.
Signing with OpenPGP is optional. It lets researchers confirm the file hasn’t been tampered with. This tool detects a signature but doesn’t verify it.
An RFC 3339 date and time, such as 2027-01-01T00:00:00.000Z. RFC 9116 recommends a date less than a year in the future.
Related Tools
Explore more high-performance utilities.