Security.txt (RFC 9116)
Security.txt is a standard file that tells security researchers how to report vulnerabilities responsibly.
Want the result for your own site? Free Robots.txt & Security.txt Checker — paste your domain, get the report.
Why It Matters
Without clear reporting instructions, researchers might disclose vulnerabilities publicly or give up trying to report them. Security.txt makes responsible disclosure easier.
How We Check
We check for /.well-known/security.txt with required fields (Contact, Expires) and recommended fields (Encryption, Acknowledgments).
How to Fix
Create /.well-known/security.txt with Contact (email or URL), Expires date, and optionally Encryption key and Policy URL. Sign it with PGP if possible.
Frequently Asked Questions
What is Security.txt (RFC 9116)?
Security.txt is a standard file that tells security researchers how to report vulnerabilities responsibly.
Why does Security.txt (RFC 9116) matter for website security?
Without clear reporting instructions, researchers might disclose vulnerabilities publicly or give up trying to report them. Security.txt makes responsible disclosure easier.
How do I fix Security.txt (RFC 9116) issues?
Create /.well-known/security.txt with Contact (email or URL), Expires date, and optionally Encryption key and Policy URL. Sign it with PGP if possible.
Related Security Checks
Related Tool
Robots.txt & Security.txt Checker
Run all 3 related checks with our free robots.txt & security.txt checker
Check Your Website Now
Run a free security scan to check for Security.txt (RFC 9116) issues and 62+ other security vulnerabilities.
Scan Your Website Free