SEC.TXT
WAITINGsecurity.txt
Enter a domain above to run this check.
SECURITY.TXT
CHECK.
Read the /.well-known/security.txt of the site: Contact, Expires, languages and PGP signature, and use a ready template that follows RFC 9116.
Runs only this check. For all 33 checks at once, use the full Domain X-Ray. Public lookups only; nothing is stored on the server.
What the check verifies
Reads /.well-known/security.txt (RFC 9116): the contact for reporting vulnerabilities, the expiry of the file and the accepted languages.
Why it matters
Without a published contact, whoever finds a flaw on your site does not know whom to tell, or tells the public.
What each result means
- OK
- security.txt with Contact and an Expires date that is still valid.
- WARNING
- No Expires, which is required, or the date has passed.
- INFO
- No security.txt published.
ERROR and TIMEOUT mean the query did not finish (the source was down or slow), not a problem with the domain: run the check again.
How to fix
Publish it as plain text at /.well-known/security.txt and renew the Expires before it passes (up to 1 year ahead):
Contact: mailto:security@example.com
Expires: 2027-10-15T00:00:00Z
Preferred-Languages: en
Canonical: https://example.com/.well-known/security.txtWould rather have someone else do it? Bit Happens can fix this →
More checks in Website and HTTPS
- Site status
- HTTPS redirect
- HSTS
- Security headers
- Cookies
- Server, CDN and WAF
- robots.txt
- Sitemap
- Title, description and social
- Mixed content and SRI
- Third parties and trackers
Full Domain X-Ray: all 33 DNS, email, HTTPS, certificate and reputation checks at once →