Free security.txt Checker
Read any site's security.txt and check it against RFC 9116: the contact, the expiry date, the canonical address, the signature, and what a researcher would miss. No file yet? Get one to publish.
Enter any domain to read its security.txt and see what a researcher sees when they want to report a hole.
Three things a security.txt gets right or wrong
A file that exists is not a file that works. A dead mailbox, a passed expiry date or a missing canonical address each send a researcher away, or send their report to the wrong hands.
Contact
RequiredWhere a researcher writes: a mailbox someone reads, an https: form, or a phone number. The one field no file may be without, and the one most often pointing at a mailbox nobody checks.
Expires
RequiredThe date after which the file is stale. Under a year ahead, so it gets reviewed; past it, readers treat the whole file as unreliable. Renew it with the calendar, not after a report bounces.
Canonical and signature
TrustCanonical names the address the file lives at; a PGP cleartext signature proves who wrote it. Together they stop a planted file from redirecting reports to an attacker.
Know when your security.txt goes stale.
FortWatch's sensitive-files scan flags a missing security.txt on every asset you own and reads it again on every scan, so an expired date or a dead mailbox is a finding with a fix, not a report that never arrived.
- A missing or expired security.txt flagged on every domain, not just one
- Checked again on every scan, with an alert when it changes
- The file to publish written out for each finding
Common questions about security.txt
What is security.txt?
▾
security.txt is a small text file at https://yourdomain/.well-known/security.txt that tells security researchers how to report a vulnerability to you: where to write, which language, which key to encrypt with, and where your disclosure policy is. RFC 9116 defines it. Without one, a researcher who finds a hole has to guess at an address, and many give up or post in public.
Which fields are required?
▾
Two. Contact, at least one line with a mailto: address, an https: page or a tel: number, in order of preference. Expires, exactly one line with an ISO 8601 date after which the file is stale; the RFC recommends under a year ahead, so the file gets reviewed. Everything else is optional: Canonical, Encryption, Acknowledgments, Preferred-Languages, Policy and Hiring.
What does the Canonical field do?
▾
Canonical names the address the file is meant to live at, for example https://yourdomain/.well-known/security.txt. A copy of the file placed on another host then reads as foreign, and a signed file can be checked against the address it claims. The checker compares it with the address it fetched.
Should the file be signed?
▾
It is optional, and it is the one way a reader can verify the file is yours rather than something an attacker planted after taking over a host. Sign it as a PGP cleartext message and publish the key under Encryption, with its fingerprint. The checker reports whether a signature is present; it does not verify the key.
Where must the file be served, and in what format?
▾
At /.well-known/security.txt over https, as text/plain with charset=utf-8. The old location, /security.txt at the root, is still read by some tools, so serving both is fine, with the well-known one as Canonical. A file served as HTML, or over http only, fails the checks that read it.
How does this checker work, and is it free?
▾
Our server fetches /.well-known/security.txt, and when that is not there, /security.txt, from the domain you name, reads up to 64 KB, and your browser checks the fields against RFC 9116. One request to the site, nothing stored. It is free, with no signup; the limit is ten checks a minute per visitor so the address our scanners share is never abused.
Try another tool
DMARC & SPF Checker
Check any domain's SPF, DMARC, and DKIM records. Catch what spoofers can exploit.
SPF Record Checker
Any domain's SPF record: policy, lookup count against the limit of 10, authorized senders.
DKIM Checker
The DKIM key of any domain at its selector or the common ones, with the public key checked.
DNS Lookup
A, AAAA, MX, NS, TXT, CNAME records for any domain — direct from Cloudflare 1.1.1.1.
Subdomain Finder
Find every subdomain a domain has ever issued a certificate for via Certificate Transparency logs.
Security Headers Checker
Grade any site's HTTP security headers — missing, weak, and what your server leaks.
CAA Record Checker
Which certificate authorities a domain allows to issue its certificates, and what to publish when none is set.
DNSSEC Checker
Whether a domain is signed and validated: DS at the parent, the DNSKEY set, the chain resolvers accept.
Subdomain Takeover Checker
Subdomains whose CNAME points at a service that no longer answers, the records an attacker can claim.