# IndieSecurityTXT > Check a site's security.txt against RFC 9116: location, media type, redirects, format, Contact, Expires, Canonical, and signature, with the fix for each gap. See whether your security.txt is where researchers look, and what to fix in it. The canonical page is https://indiesecuritytxt.com/. ## Use the tool Open [IndieSecurityTXT](https://indiesecuritytxt.com/) to complete the job. The questions below describe the supported input, result, and limits. Every answer names its source next to it. Source: [RFC 9116, security.txt](https://www.rfc-editor.org/rfc/rfc9116.html). ## Questions and limits ### What is security.txt? `security.txt` is a plain-text file at `/.well-known/security.txt` that tells a security researcher how to report a vulnerability in your site. [RFC 9116](https://www.rfc-editor.org/rfc/rfc9116.html) defines it. Two fields are required: `Contact`, a `mailto:`, `tel:`, or `https://` URI for reports, and `Expires`, the date after which the file is stale. Optional fields add an encryption key, a disclosure policy, an acknowledgments page, hiring, preferred languages, and a `Canonical` address. ### What does a security.txt checker grade? Eight rules, each linked to the RFC section it comes from: the location and HTTPS, the `text/plain; charset=utf-8` media type, any redirect on the way, the line grammar and size limits, `Contact`, `Expires`, `Canonical`, and an OpenPGP signature. A fail is a required rule broken: no file, a missing or malformed `Contact` or `Expires`, an expired date, a response that is a web page, or a wrong media type. A warn is a gap the RFC recommends closing. The optional fields are listed below the rules. ### Why does my security.txt say expired? The `Expires` value is in the past. The RFC says a researcher should not use stale data and that no file may be better than a stale one, so an expired file fails even when every other line is right. Set a new RFC 3339 date-time such as `2027-09-01T00:00:00Z`, under a year away so the file gets revisited; the result suggests one. After a check whose date lies ahead, you can download a calendar reminder for 30, 14, or 7 days before it. Nothing else watches the date for you. ### Where should security.txt be located? At `/.well-known/security.txt` on the exact host it speaks for, served over HTTPS as `text/plain; charset=utf-8`. The RFC allows a copy at `/security.txt` for older tools, but that top-level copy is not enough on its own: the checker reads it only as a fallback and asks you to publish at the well-known path or redirect to it. A redirect to another host is allowed, but the file then speaks for both addresses only if `Canonical` lists both. ### How do I fix a failing security.txt? Each row carries the fix as the exact line to write. When the verdict is not a pass, the result also assembles the whole file to publish: your usable `Contact` lines, a fresh `Expires`, the `Canonical` address of the well-known path, and the optional fields it read. Edit the renewal draft, check supported fields locally, and copy or download the exact text. The local check shows line-numbered findings and compares Expires with the current device time. It does not publish the draft, visit contact URLs, or verify signatures; check the live file again after publishing. Common fixes are a bare email address, which must become `mailto:`, plain `http://` in `Contact`, which must be `https://`, and a catch-all route that answers the path with a web page instead of returning 404. ### What can the checker not verify? Whether anyone reads the mailbox. A `Contact` line is graded on its shape, not on whether a report reaches a person. An OpenPGP signature is detected and checked for shape, not verified, and even a valid signature proves control of a key, not that the key belongs to the site. Every check reads one host at one moment, so a subdomain with its own file needs its own check. Publishing the file also grants no permission to test; say what is allowed in `Policy`. ## Promises - The core is free: no account, no card, no premium plan, no upgrade nag, no hidden paywall. - Private lookup activity is never published. - Analytics is currently off. Private lookup activity is never published or sent to a tracker. No lookup history becomes public inventory. ## More - [Notes](https://indiesecuritytxt.com/blog.md): posts by the maker, newest first - [More tools](https://indiesecuritytxt.com/tools.md): the other tools by turushan - [security.txt](https://indiesecuritytxt.com/.well-known/security.txt): how to report a vulnerability Made by turushan, https://twitter.com/turushan.