security.txt Generator
security.txt is a small text file (RFC 9116) that tells security researchers how to report a vulnerability in your website. Without it, a well-meaning person who finds a problem may not know who to contact — or may give up.
Contact: mailto:security@example.com Expires: 2027-10-31T23:59:59Z Preferred-Languages: en Canonical: https://example.com/.well-known/security.txt
Where to put the file
Save the output as security.txt and publish it at https://yourdomain/.well-known/security.txt (served as plain text over HTTPS). The Contact and Expires fields are required; set a reminder to update the expiry date before it passes.
Use a monitored mailbox or form for Contact, and decide in advance who triages reports.
Frequently asked questions
Is security.txt required?
Not by law in most places, but it is a widely adopted standard and a cheap way to receive vulnerability reports instead of having them published or ignored.
What should Expires be?
A date less than a year ahead is recommended, so stale contact details don't linger. Renew it regularly.
Should I sign the file?
Optionally, with OpenPGP clear-signing, so researchers can verify it wasn't tampered with.
More free security tools
Advertisement