Free Security.txt Checker
Fetch and parse a public security.txt file so security teams and site owners can confirm vulnerability disclosure contacts, expiry dates, canonical URLs, policy links, and related RFC 9116 fields.
Common use cases
- Confirm vulnerability disclosure contacts before reporting a security issue.
- Audit whether security.txt is published at the well-known location.
- Check expiry and canonical fields during a security review or launch checklist.
Frequently asked questions
Where should security.txt live?
The standard location is /.well-known/security.txt. NerdTools also checks /security.txt as a fallback.
What fields are important?
At minimum, RFC 9116 expects Contact and Expires fields. Canonical, Encryption, Policy, Acknowledgments, and Preferred-Languages can provide useful extra context.