Security.txt

What SecurityStatus Checks

• Whether a security.txt file exists at /.well-known/security.txt or /security.txt
• Whether the file contains the required Contact field
• Whether the file has an Expires field (required by RFC 9116)
• Whether the file is digitally signed (recommended)

Why This Matters

Responsible security researchers who find vulnerabilities in your site want to report them privately. Without a security.txt, they often give up or go public after failing to find a contact. A security.txt gives you a chance to fix issues before they become public, potentially preventing breaches.

How to Fix It

1. 1

   Create the security.txt file

   Create a file at your web root: `/.well-known/security.txt`. Minimum content: `Contact: mailto:security@yourdomain.com` and `Expires: 2026-12-31T23:59:59Z`.

2. 2

   Add all relevant fields

   A complete security.txt includes: Contact (required), Expires (required), Policy (link to your security policy), Acknowledgments (link to your hall of fame), Preferred-Languages, and optionally Encryption (PGP key URL).

3. 3

   Set up the security contact

   The Contact email should go to someone who can actually respond. Set up a dedicated security@yourdomain.com alias that routes to your security team or a ticketing system.

4. 4

   Optionally sign the file with PGP

   Sign your security.txt with your organisation's PGP key to prove authenticity. Add the Encryption field pointing to your public key. This is optional but signals higher security maturity.

Frequently Asked Questions

Related Guides