Guides › Free tools
security.txt Generator & Checker (RFC 9116)
Check an existing security.txt against RFC 9116, or generate a valid one below. We fetch /.well-known/security.txt (and the legacy /security.txt), then check the required Contact and Expires fields, field syntax, HTTPS, PGP signing and Canonical.
security.txt generator
Save this as /.well-known/security.txt, served as text/plain over HTTPS. Update Expires before it passes.
What is security.txt?
security.txt is a small text file, standardized as RFC 9116 in 2022, that tells security researchers how to report a vulnerability in your site. It lives at https://yourdomain/.well-known/security.txt. Many security scanners flag its absence as "security.txt not configured".
Required and optional fields
| Field | Required? | Notes |
|---|---|---|
| Contact | Yes, at least one | A URI: mailto:, https:// or tel:. List the preferred method first. |
| Expires | Yes, exactly one | An ISO 8601 timestamp. The RFC recommends less than a year ahead. |
| Encryption | No | Link to your PGP key (not the key itself). |
| Canonical | No | Where the file is meant to live. Recommended when signed. |
| Policy, Acknowledgments, Hiring | No | Links to your disclosure policy, hall of fame and security jobs. |
| Preferred-Languages | No | Comma-separated language tags, at most once. |
Fixing "security.txt not configured"
- Generate the file above and save it as
.well-known/security.txtin your web root (on WordPress, Shopify or a static host, any way of serving a plain text file at that path works). - Make sure it is served over HTTPS with
Content-Type: text/plain. - Set a calendar reminder to update
Expires, because an expired file is treated as stale. - Run the checker above to confirm.
Check your site now