Security.txt checker: does this site tell researchers where to report a vulnerability?
In short: Paste websites and see, for each, whether /.well-known/security.txt exists, has the required Contact and Expires fields, hasn't expired and follows RFC 9116, with every contact listed. Limit: It reads the file's format; it doesn't contact anyone or confirm a Contact address works.
A security.txt checker fetches a site's /.well-known/security.txt and reads it against RFC 9116. Paste one site or up to 100 (500 after a Google sign-in): each gets Valid, Expired, Has errors, No security.txt or Unreachable, with its Contact addresses, the Expires date and days left, and each rule the file breaks, such as a missing Expires or an http:// link.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. See pricing
Sample result
globex.example has a security.txt, but its Expires date passed 41 days ago.
- Website
- globex.example
- Contact
- mailto:[email protected]
- Expires
- 41 days ago
What this means for you
Know which sites tell researchers where to report, and which files are stale or broken.
- Contact and Expires checked
- Days left before it expires
- /.well-known first, legacy path second
- 100 sites a run, 500 when signed in
- security.txt
- RFC 9116
- Disclosure
By SimpleVerifier Team · Last updated
Checking security.txt across a whole portfolio?
- Over 500 sites? Run them in batches of 500 when signed in and download the CSV after each.
- Sort the CSV by days_left to find files about to expire.
- Emailing the security contacts you found? Check the addresses at /verify first. The first 100 email checks are free with a Google sign-in, no card.
How do I check if a website has a security.txt file?
- Paste one website or a list, one per line: up to 100 a run, or 500 after a free Google sign-in.
- Press Check security.txt. Each site's /.well-known/security.txt is fetched over HTTPS, then the legacy /security.txt if the first has no file.
- Read the verdict, the Contact lines, the Expires date and every error or note.
- Download the CSV with contacts, expiry and problems for each site.
Example
- You enter
- Three websites:
acme.example,globex.exampleandinitech.example. - You get
acme.exampleValid: Contact mailto:[email protected], expires in 212 days.globex.exampleExpired: well formed, but Expires passed 41 days ago.initech.exampleHas errors: no Expires field, and Policy uses http://. Download the CSV with contacts and days left.- Limits
- Up to 100 websites a run without an account and 500 when signed in with Google. HTTPS only, as RFC 9116 requires.
What does RFC 9116 require in a security.txt file?
Two fields. Contact says how to report a vulnerability and may appear several times, each a mailto:, https:// or tel: URI, in order of preference. Expires must appear exactly once, as an RFC 3339 date-time such as 2027-03-31T23:59:59Z; RFC 9116 section 2.5.5 recommends a date less than a year ahead, so the file gets reviewed and a stale contact doesn't sit there for years.
Everything else is optional: Encryption (a key for encrypted reports), Acknowledgments, Policy, Hiring, Preferred-Languages (at most once) and Canonical, the URLs where this file is meant to live. Web links in any field must use https://. The IANA field registry also lists CSAF, added later for machine-readable advisories.
Where should the file go, and why does HTTPS matter?
At /.well-known/security.txt, the path registered under RFC 8615 for well-known files. A copy at the top-level /security.txt is allowed for older tools, but when both exist the /.well-known one wins, so the checker reads that first and only falls back to the legacy path when it has no file.
The RFC requires HTTPS because a contact address is exactly what an attacker would want to swap: over plain HTTP, anyone on the network path could redirect reports to themselves. The checker only fetches over HTTPS for the same reason, and an HTML page served in place of the file (a common catch-all 404) counts as no file.
What is the difference between Expired and Has errors?
| Status | What it means | What to change |
|---|---|---|
| Valid | Contact and a future Expires, nothing that breaks RFC 9116. | Nothing; renew Expires before it passes. |
| Expired | Well formed, but the Expires date is in the past. | Confirm the contacts still work and set a new date. |
| Has errors | No Contact, no or a malformed Expires, Expires twice, http:// links or plain-HTTP serving. | Fix each line listed in red. |
| No security.txt | Both paths answer 4xx, or an HTML page. | Publish one at /.well-known/security.txt. |
Who uses this tool, and for what?
- Security teams
- Catch security.txt files that expired quietly since they were last updated.
- Bug bounty hunters
- Find the right reporting contact for a list of in-scope domains.
- Agencies
- Audit security.txt across every client site before a compliance audit.
- Vendor risk teams
- See which suppliers publish a vulnerability contact at all.
What can’t this tool tell you?
- It reads the file's format; it doesn't contact anyone or confirm a Contact address works.
- OpenPGP signatures are recognised but not verified.
- Only HTTPS is fetched, as RFC 9116 requires; a file served only over HTTP counts as missing.
- Up to 100 sites a run without an account and 500 signed in.
Common questions
- Is security.txt required?
- Not by law in most places. It's an IETF standard (RFC 9116) that gives researchers one predictable place to find a contact. Some security programmes and procurement checklists ask for it.
- Does a valid file mean the site is secure?
- No. It only says where reports should go. The checker doesn't test the site for vulnerabilities, and nothing is sent to the contacts.
- Is the OpenPGP signature checked?
- The checker recognises a cleartext-signed file and reads the fields inside it, but doesn't verify the signature against a key.
- Why is my file found but marked Has errors?
- Usually a missing or malformed Expires (it must be a full RFC 3339 date-time with a time zone), or a Contact that isn't a mailto:, https:// or tel: URI. Each error is listed under the site.
- Can I check many sites at once?
- Yes. 100 sites a run without an account and 500 after a free Google sign-in, with a CSV that includes the days left before each file expires.
- Is the security.txt checker free?
- Yes, it's a free tool with no card. One or two HTTPS requests per site.
Sources
You audited one domain. Cold outreach means thousands.
This tool checks a domain you type in. It will not tell you which addresses at that domain are real.
- Bulk mailbox verification with real SMTP checks
- The email finder — name plus company to a verified address
- Website enrichment for emails, owner names and socials
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.