security.txt Checker
A security.txt file tells researchers how to report vulnerabilities. See whether yours is valid.
GO DEEPERWhat do you want to uncover next?
What this tool checks
- File found at /.well-known/security.txt
- Contact and Expires fields
- Expires date in the future
- Served over HTTPS as plain text
- Optional fields and signature
How to read the result
The file must have a Contact and an Expires field. If it is missing, the tool generates a starter you can adapt and place at /.well-known/security.txt.
Terms explained
Frequently asked questions
Is security.txt required?
No, but it is a recommended standard that speeds up responsible disclosure.
Where does it go?
At /.well-known/security.txt on your domain, served over HTTPS.
How often should I update it?
Renew the Expires date at least yearly.