security.txt Checker
Check a security.txt file against RFC 9116, including the expiry that makes it valid.
What you provide
Paste the file. It belongs at /.well-known/security.txt over HTTPS.
How this calculation works
The pasted file is parsed and checked against RFC 9116. Two fields are mandatory: Contact, which is the entire point of the file, and Expires, which is the one that surprises people. The specification says a file past its expiry date is to be treated as invalid — the field was made mandatory precisely because these files get written once and abandoned, and an abandoned file quietly misdirects vulnerability reports to a mailbox nobody has read in years. So an expiry in the past is reported as a failure rather than a note.
What the results mean
- Contact
- Mandatory. A URL or mailto where reports should go.
- Expires
- Mandatory since RFC 9116. Past its date, the file is formally invalid.
- Canonical
- Where the file officially lives, so a copy found elsewhere can be checked against it.
- Encryption
- A link to a public key — never the key itself inline.
Common problems and fixes
- My file is rejected for a missing Expires
- It became mandatory in RFC 9116. Add a date within the next year and set a reminder, since an expired file counts as invalid.
- Where does the file belong?
- At /.well-known/security.txt over HTTPS. The root-level location is a legacy fallback and should not be the only copy.
- Should I sign it?
- Optional and worth it for a large organisation, since it lets a reporter verify the contact details were not tampered with in transit. A signature is not checked here.
Frequently asked questions
What is security.txt for?
Telling security researchers where to report a vulnerability. Without one, a finder has to guess between a support form, a sales address and social media — which is how genuine reports get lost.
Why is Expires mandatory?
Because these files get written once and forgotten. A mandatory expiry means an abandoned file eventually announces itself as stale rather than quietly directing reports at a mailbox nobody reads.
Does it need to be at /.well-known/?
Yes, that is the defined location. A copy at the root is a legacy fallback that some tools still check, but the well-known path is the one that counts.
Put this on your own site
Free to embed, no attribution required beyond the source link the frame carries itself. It runs entirely in your visitor's browser, sets no cookies and loads no third-party script.
<iframe src="https://runthetests.com/embed/security-txt-check/" width="100%" height="560" style="border:1px solid #e5e5e5;border-radius:8px" title="security.txt Checker" loading="lazy"></iframe>
Preview it at https://runthetests.com/embed/security-txt-check/. Embedded pages are marked noindex, so yours stays the canonical copy — not this one.