When a researcher finds a hole in a website, the first place they look for a way to report it is
/.well-known/security.txt. RFC 9116 defines that file: a few plain-text lines that say how to
reach the people who can fix things, and when the file itself goes stale. Most small sites have no
such file. Many that do have one that expired a year ago, or one that says security@ without the
mailto: the RFC requires, or one that a catch-all route replaced with the home page.
IndieSecurityTXT asks. Enter a domain. The tool requests https://domain/.well-known/security.txt
once from Cloudflare’s network, and the legacy top-level /security.txt only when the well-known
path has nothing. It reads the file and grades eight rules from the RFC: the location, the media
type, any redirects, the format, the two required fields Contact and Expires, and the two
recommended ones, Canonical and the OpenPGP signature. Below those, it reads the optional fields:
Encryption, Policy, Acknowledgments, Hiring, Preferred-Languages, and anything else. Every row says
what was found, what the RFC asks for, and the exact line to change, and links the section of the
RFC it rests on with the day it was read. When anything is wrong, the result ends with the whole
file to publish, assembled from what the site already says with the gaps filled.
Three things keep the answer honest. The file does not grant anyone permission to test a site, and the result says so; permission lives in the policy the file links to, if it lives anywhere. A signature is detected, not verified: a valid signature proves control of a key, not that the key belongs to the site, and a researcher checks that another way. And the tool visits nothing the file points to. It reads one file, and it says what one request received.
Where the file goes depends on the host. Astro, Next.js, Vite, and most static builders copy a
public/ folder to the site root, so the file is public/.well-known/security.txt. Cloudflare
Workers with static assets and Cloudflare Pages serve it from the build output the same way, and a
_headers file can add the charset if the host leaves it off. On nginx it is a file in the web
root, with charset utf-8; in the server block so the media type reads text/plain; charset=utf-8. On GitHub Pages with Jekyll, dot folders are skipped unless _config.yml lists
.well-known under include.
The first thing IndieSecurityTXT checked was its own family. No sister site had the file, and this one publishes its own from the first deploy. The fix for the rest is one file in the shared template, and it reaches every site in one sweep. That is the kind of gap this tool exists to find.
The core stays free. There is no account, no card, no premium plan, and no public list of checked sites. IndieSecurityTXT stores no lookup history and loads no analytics or third-party script.