Check a website's security.txt against RFC 9116: Contact, Expires, location and signature
Checked from our server in India. Only the address you type is sent to us; nothing else leaves your device. Checked against sources on 16 Oct 2026.A security.txt checker fetches the file a website publishes at /.well-known/security.txt and checks it against RFC 9116. This one reads it from our server over https, confirms the required Contact and Expires fields, flags an expired or distant date, http addresses, a wrong location or content type, and notes whether the file is signed.
Type the domain and press Check security.txt.
Read where the file was found and the problems listed.
Fix them and check again.
security.txt is a small text file that tells people who find a vulnerability how to report it. RFC 9116 fixes its place, /.well-known/security.txt, and its format: lines of Field: value. This checker requests that address from our server over https, following redirects, and falls back to the old top-level /security.txt only when the well-known path answers not found.
Two fields are required. Contact must appear at least once, as a URI: mailto:, tel: or an https page; a bare email address or an http link is flagged. Expires must appear exactly once, as an RFC 3339 date and time such as 2027-06-30T23:00:00.000Z. An expired file is a failure, and a date more than a year away is a warning, because the RFC recommends less than a year so the file gets reviewed.
The optional fields are checked too: Encryption, Acknowledgments, Policy, Hiring and CSAF must be URIs with https for web addresses; Preferred-Languages may appear only once; and when Canonical is given, the address the file was fetched from should be among its values, which catches a file copied from another site. Unknown fields are listed, since readers ignore them.
How the file is served matters as well: it must arrive over https and as text/plain; charset=utf-8. An HTML answer is usually an error page with status 200 and is reported as such.
An OpenPGP signature is detected and the fields inside it are read, but the signature itself is not verified. The contacts are listed, not tested.
At /.well-known/security.txt on the website, served over https, as RFC 9116 requires. The top-level /security.txt is only for older tools and may simply redirect to the well-known path. The checker tries the well-known address first and warns when only the old one answers.
Two. Contact gives at least one way to report a problem, written as a URI such as mailto:[email protected], tel:+1-201-555-0123 or an https web page. Expires gives the date after which the file should not be trusted, in RFC 3339 form, and must appear exactly once.
Less than a year, according to RFC 9116, so that someone reviews the contacts at least once a year. The checker warns about a date more than a year away and about one less than 30 days away, and fails a file whose date has passed, because readers should then treat it as stale.
No, a signature is optional. An OpenPGP cleartext signature lets readers confirm the file was not changed by someone else. The checker detects a signed file and reads the fields inside it, but it does not verify the signature against a key.
text/plain with charset=utf-8. Many servers send text/plain without the charset, which is noted. A file served as text/html is flagged as a failure, because it is usually a site error page answering with status 200 rather than the real file.
Not generally. It is a voluntary standard, but bug bounty platforms, security scanners and some government guidance expect it, and it is the simplest way to make sure a researcher who finds a flaw can reach the right person instead of posting it publicly.
Rates and rules change; check the source before you rely on a figure.
Still stuck? Ask about Security.txt Checker and anybody who knows can answer. No account needed.
Same job, other tools: TXT Record Lookup – Read the TXT records of a domain: SPF, site verification codes and other text.
On the related tools: IP to ASN Lookup – Map an IP address to the ASN that announces it, with the BGP prefix.