security.txt generator
Create a security.txt file so researchers know how to report a problem.
FreeRuns in your browserNo signupUpdated 2026-11-05
Field names and rules follow RFC 9116. Signing the file with an OpenPGP cleartext signature is optional and done on your own machine.
Status
Valid
Contact and Expires are the only required fields
Expires
…
Midnight UTC, written in RFC 3339 format
# How to report a security problem, in order of preference Contact: mailto:security@example.com Contact: https://www.example.com/security/report # This file is out of date after this date Expires: … # Key for encrypting your report Encryption: https://www.example.com/.well-known/pgp-key.txt # Our disclosure policy Policy: https://www.example.com/security/policy # Languages we read reports in Preferred-Languages: en # Where this file lives Canonical: https://www.example.com/.well-known/security.txt
Upload it so it is served as text/plain at https://www.example.com/.well-known/security.txt
About this tool
How it works and how to read the result.
Need this done for you?
Website care & maintenance
Hosting, updates, backups and fixes, handled for you.
See the serviceWhat it does
A security.txt file tells security researchers how to report a problem with your website. It is a short plain-text file defined by RFC 9116, an internet standard published in 2022. This generator writes the file from a few inputs, converts bare emails and phone numbers into the mailto: and tel: forms the standard requires, works out an Expires date, and checks each field as you type: web links must use https://, at least one Contact must be present, and language codes must look like real tags.
How to use it
- Enter your site URL.
- List one or more ways to reach you, most preferred first. An address such as security@yourdomain.com is common.
- Pick when the file expires. Twelve months is the longest the RFC recommends.
- Add links to your PGP key and disclosure policy if you have them. Leave the rest empty if you do not.
- Download the file and upload it to the .well-known folder on your server.
How to read the result
With the defaults, the file has seven fields: two Contact lines (an email and a report form), one Expires line set a year ahead, then Encryption, Policy, Preferred-Languages and Canonical. Each block has a short comment starting with #, which the RFC allows and readers ignore. Untick "Add comments" for a bare file.
The Expires value looks like 2027-11-05T00:00:00Z. That is midnight UTC on the date shown in the Expires stat. Once that date passes, researchers are told to treat the file as stale, so put a reminder in your calendar to update it a few weeks before.
The Status stat turns red when something breaks the standard, such as an http:// contact or no contact at all, and amber for advice, such as an email contact with no Encryption link. An empty Checks panel means the file follows RFC 9116.
The Canonical line repeats the file's own address. It matters most if you sign the file with an OpenPGP cleartext signature, because it stops someone reusing your signed file on another domain. Signing is optional and is done with your own key, outside this page.
Keeping files like this current is part of routine site care. Our website maintenance service covers security headers, updates and monitoring. To list the paths crawlers should skip, use the robots.txt generator.
Questions
Frequently asked.
Where does security.txt go?
In the .well-known folder at the root of the site, so it loads at https://www.example.com/.well-known/security.txt. RFC 9116 allows a copy at /security.txt for older tools, but the .well-known path takes priority. It must be served over HTTPS as plain text in UTF-8.
Which fields are required?
Only two: at least one Contact and exactly one Expires. Contact can be an email written as mailto:, a phone number written as tel:, or an https:// link to a form. Everything else, including Encryption, Policy, Acknowledgments, Preferred-Languages, Canonical and Hiring, is optional.
Do small business sites need one?
It is not a legal requirement in most places, but it costs nothing and gives anyone who finds a problem on your site a clear way to tell you. Without it, a researcher may give up, guess an address, or post the problem publicly. Some security scanners also check for the file.
Your next move
Like what you see? Tell us about it.
A process that takes too long, a website that undersells you, or an idea ready to take shape. Tell us where you are and we will suggest a useful next step.
India · Working with clients worldwide