Is your security.txt valid?

security.txt is a plain-text file at /.well-known/security.txt that tells a security researcher how to report a vulnerability in your site. RFC 9116 defines it. Two fields are required: Contact, a mailto:, tel:, or https:// URI for reports, and Expires, the date after which the file is stale. Optional fields add an encryption key, a disclosure policy, an acknowledgments page, hiring, preferred languages, and a Canonical address.

Eight rules, each linked to the RFC section it comes from: the location and HTTPS, the text/plain; charset=utf-8 media type, any redirect on the way, the line grammar and size limits, Contact, Expires, Canonical, and an OpenPGP signature. A fail is a required rule broken: no file, a missing or malformed Contact or Expires, an expired date, a response that is a web page, or a wrong media type. A warn is a gap the RFC recommends closing. The optional fields are listed below the rules.

The Expires value is in the past. The RFC says a researcher should not use stale data and that no file may be better than a stale one, so an expired file fails even when every other line is right. Set a new RFC 3339 date-time such as 2027-09-01T00:00:00Z, under a year away so the file gets revisited; the result suggests one. After a check whose date lies ahead, you can download a calendar reminder for 30, 14, or 7 days before it. Nothing else watches the date for you.

At /.well-known/security.txt on the exact host it speaks for, served over HTTPS as text/plain; charset=utf-8. The RFC allows a copy at /security.txt for older tools, but that top-level copy is not enough on its own: the checker reads it only as a fallback and asks you to publish at the well-known path or redirect to it. A redirect to another host is allowed, but the file then speaks for both addresses only if Canonical lists both.

Each row carries the fix as the exact line to write. When the verdict is not a pass, the result also assembles the whole file to publish: your usable Contact lines, a fresh Expires, the Canonical address of the well-known path, and the optional fields it read. Edit the renewal draft, check supported fields locally, and copy or download the exact text. The local check shows line-numbered findings and compares Expires with the current device time. It does not publish the draft, visit contact URLs, or verify signatures; check the live file again after publishing. Common fixes are a bare email address, which must become mailto:, plain http:// in Contact, which must be https://, and a catch-all route that answers the path with a web page instead of returning 404.

Whether anyone reads the mailbox. A Contact line is graded on its shape, not on whether a report reaches a person. An OpenPGP signature is detected and checked for shape, not verified, and even a valid signature proves control of a key, not that the key belongs to the site. Every check reads one host at one moment, so a subdomain with its own file needs its own check. Publishing the file also grants no permission to test; say what is allowed in Policy.

Yes. No account, no card, no premium plan, no upgrade nag, no hidden paywall. IndieSecurityTXT is free, all of it.

There is no public lookup history. A network check sends the public input needed for that check to its named source. Local file tools process file contents in your browser. Analytics is currently off, so no visit or job data is sent to a tracker. Anything the tool saves for you stays in your browser.