Vulnerability Disclosure
Draft a valid RFC 9116 file in under a minute. Add your contact and expiry, then copy or download it to /.well-known/security.txt. Already have one? Validate it here.
How researchers reach you. One per line. Use mailto:, https:// or tel:.
When the file should be considered stale. Keep it under a year out.
Optional fields
URL of your PGP public key.
Your vulnerability disclosure policy.
Page thanking researchers who reported issues.
Comma-separated language tags (e.g. en, de).
The canonical location of this file.
Link to your security job openings.
Contact: mailto:security@example.com Expires: 2027-08-04T23:59:59.000Z
Serve the file at /.well-known/security.txt over HTTPS with a text/plain content type. Once it is live, validate it to confirm it parses correctly.
The most common failure is a file that quietly lapses. In our scan of the top 500 sites, nearly half of published files were already expired or invalid. Monitoring your security.txt means you are reminded before that happens.
A security.txt file (RFC 9116) is a small text file that tells security researchers how to report a vulnerability in your site. It lives at /.well-known/security.txt and lists your contact details, an expiry date, and optionally an encryption key and disclosure policy. It gives researchers a direct, trusted channel instead of a generic contact form.
Upload it to /.well-known/security.txt on your web server, so it is reachable at https://yourdomain.com/.well-known/security.txt over HTTPS. You can also place a copy at /security.txt as a fallback, but the .well-known location is the standard one automated tools check first.
RFC 9116 requires two: at least one Contact (a mailto:, https:// or tel: URL) and an Expires date. Everything else, Encryption, Policy, Acknowledgments, Canonical, Hiring, and Preferred-Languages, is optional but recommended where it applies.
Set it no more than a year in the future. The Expires field tells researchers when to stop trusting the file, which is why so many published files quietly go stale. This generator defaults to one year out, and the smart move is to monitor the file so you are reminded before it lapses.
Signing is optional. A PGP signature proves the file was published by whoever controls the key, so a researcher can be sure they are reading the authentic file. If you have a key, add its URL in the Encryption field and sign the file after generating it. If not, an unsigned file is still perfectly valid.
SiteSecurityScore monitors your security.txt and 100+ other security checks continuously, and alerts you the moment something expires or breaks.
Start monitoring your site