Cookies on AIGROW

We use necessary cookies to run the site. With your permission, we also use cookies for analytics, session recordings and marketing attribution.

Cookie Policy

Security.txt checker

Enter your domain and this security.txt checker reads the file at /.well-known/security.txt, checks every line against RFC 9116 and explains each problem in plain words. You get a corrected file to copy, with a contact address, an expiry date less than a year away and the canonical URL.

Free, no account. Ten checks per hour. We read the security.txt file only and open nothing it links to.

We send the host to our API, which asks your site for the file over HTTPS. Answers are kept for five minutes.

A security.txt file tells security researchers how to report a vulnerability to you. RFC 9116 asks for it at /.well-known/security.txt over HTTPS, with at least one Contact line and one Expires date in the future. This checker reads that file, checks every field against the RFC and gives you a corrected file to publish.

How to use this checker

Enter your domain
Type the host that serves your website, such as example.com. A security.txt file covers only the host it is read from, so www.example.com is checked as a host of its own. The result has its own link, so you can send it to whoever runs the site.
Read the findings
Errors break a rule in RFC 9116, such as a missing Contact line or an Expires date in the past. Advice covers what the RFC recommends, such as a signature or a Canonical line. Each finding names the line it is about.
Publish the corrected file
Copy the corrected file, check the contact address and save it as /.well-known/security.txt, served as text/plain over HTTPS. Put the Expires date in your calendar and publish a new file before it passes.

Questions about this checker

A plain text file, defined in RFC 9116, that tells people who find a security problem on your site how to reach you. It lists at least one contact, such as an email address or a web form, and a date after which the file is considered stale.

Contact and Expires. Contact must be a URI, such as mailto:security@example.com or an https link to a form, and it may appear more than once. Expires must appear once, as a date and time such as 2027-06-30T00:00:00Z, and the RFC recommends a date less than a year away.

RFC 9116 says websites must place the file under the /.well-known/ path. A file at the top-level /security.txt is allowed only for older tools, and when both exist the /.well-known/ one must be used. A file found only at the top level is reported as an error here.

It asks for https://your-host/.well-known/security.txt and, only if that is missing, /security.txt, following redirects that stay on HTTPS. It opens no other page and contacts nobody listed in the file. It checks the shape of an OpenPGP signature, but cannot verify it without your public key.

The Regulation does not name the file. Annex I, Part II, point 6 asks manufacturers of products with digital elements to provide a contact address for reporting vulnerabilities, and security.txt is one public place to give it. This page is a technical check, not legal advice.

Yes. The page address carries the host, as in ?domain=example.com, so anyone who opens the link runs the same check. Answers are kept for five minutes, so wait a few minutes after you publish a new file before you check again.

Related tools

  • HTTP header checker

    Inspect every redirect with the HTTP header checker. Review security grades and cookie flags, then compare browser and crawler responses.

  • SSL certificate checker

    Use this SSL certificate checker to inspect a live certificate and its chain. Review TLS support and HTTPS policy, then save an expiry reminder.

  • Email spoofing checker

    Enter your domain and this email spoofing checker tells you whether anyone can send email that claims to come from you. It reads your DMARC, SPF and DKIM records, explains each one in plain words and gives you the exact records to publish.

Want the file and the policy written for you?

The Cyber Resilience Act kit includes a security.txt file, the vulnerability disclosure policy it links to and the 24-hour reporting procedure, each duty cited to its article.

See the Cyber Resilience Act kitRun the free AI visibility scan