Web

Security.txt Tester

Policy Validation

Test a security.txt

Enter a domain name to fetch its security.txt and validate it against RFC 9116.
Fetches /.well-known/security.txt (and the legacy root location), then validates it against RFC 9116.
No domain tested yet

Enter a domain above and click Test security.txt to validate its disclosure file.

Tool features

A complete RFC 9116 security.txt validation
4 checks

Both Locations

Checks /.well-known/security.txt and the legacy root path

Line-by-Line Review

Annotates every field of the fetched file

RFC 9116 Checks

Clear pass / warn / fail on every requirement

Expiry Watch

Flags stale files that scanners will ignore

What is security.txt & how it works

How a domain publishes its vulnerability-disclosure contact

A security.txt file is a plain-text file that tells security researchers how to report a vulnerability in your site. Standardised as RFC 9116, it gives finders a sanctioned channel — an email or form — instead of leaving them to guess, so issues reach you privately rather than going public.

The file lives at /.well-known/security.txt and lists fields such as Contact and a mandatory Expires date. This tester fetches both the well-known and legacy locations, annotates the file line by line, and validates every field against RFC 9116 — location, HTTPS, syntax and expiry.

Contact
Where to report issues — a mailto: or https:// URI. At least one is required.
Expires
A required date after which the file is stale; keep it within 12 months.
.well-known
The standard path scanners check: /.well-known/security.txt over HTTPS.

How to use this tool

Validate a domain's security.txt in four steps
1
Enter a domain
Type a domain, e.g. example.com — no path needed, we build the well-known URL.
2
Run the test
Click Test security.txt to fetch the well-known and legacy locations over HTTPS.
3
Review the file
Read the line-by-line annotations and the pass/warn/fail result on every RFC 9116 rule.
4
Fix and re-test
Apply the recommendations — add Contact/Expires, move to /.well-known/, use HTTPS — then test again.

Learn more

Guides & explainers related to this tool

Article

What Is security.txt?

How the RFC 9116 disclosure file works, what each field means, and why the Expires date matters.

Guide

How to Sign security.txt with PGP

Generate a PGP key with GnuPG, publish it under Encryption, and cleartext-sign the file.

Tool

Security.txt Generator

Build a valid security.txt with Contact, Expires, and every optional field in seconds.

Tool

Secure Header Checker

Audit the rest of your site's security posture — CSP, HSTS, X-Frame-Options, and more.

Related tools

Keep debugging with tools from the same suite
4 tools
Security.txt Generator
Generate a valid RFC 9116 security.txt file with Contact, Expires, and every optional field, plus a deployment checklist
Secure Header Checker
Check security headers like CSP, HSTS, X-Frame-Options, and more with security scoring
HTTP Header Checker
Analyze HTTP response headers for any website or URL with detailed header information
SSL Checker
Comprehensive SSL certificate analysis including validity, expiration, chain verification, TLS versions, and security assessment

Frequently asked questions

Common questions about security.txt
5 Q&A

security.txt is a standardised plain-text file (RFC 9116) that tells security researchers how to report vulnerabilities to your organisation, giving them a sanctioned disclosure channel.

The canonical location is /.well-known/security.txt served over HTTPS. A legacy /security.txt at the site root is tolerated, but many scanners only check the well-known path, so prefer it.

At minimum a Contact field (a mailto: or https:// URI) and an Expires field with a future date. Fields like Encryption, Policy, Acknowledgments and Preferred-Languages are optional but recommended.

RFC 9116 makes Expires mandatory, and conforming scanners treat a file with a past (or missing) Expires date as absent. Keep it within about 12 months and renew it before it lapses.

Signing is optional but recommended. A PGP cleartext signature (with the key published under Encryption) lets researchers verify the file is authentic and has not been tampered with.