Skip to content
frabs.
All tools

/security-txt-checker

Security.txt Checker

Check whether a site publishes a valid security.txt file.

Try:

About Security.txt Checker

Security.txt Checker looks for a security.txt file at the standard /.well-known/ location defined in RFC 9116, falling back to the older root-level location, and checks that it includes the required Contact and Expires fields.

Use this to confirm a security.txt file is actually being served correctly after publishing one, since a security researcher who wants to report a vulnerability will look for this file first before trying to guess a contact address.

An expired security.txt file is treated as a genuine issue here, not just a missing one, since the specification expects the Expires date to be kept current as a signal that the contact information is still being maintained.

Tutorials

Content Security Policy ExplainedWhat a CSP header actually restricts, why it matters even on a site with no obvious vulnerabilities, and how to read one without getting lost in the syntax.6 min readHSTS Explained: What It Protects and What It Does NotWhy telling a browser to always use HTTPS closes a gap a valid certificate alone leaves open, and what to check before turning it on.5 min readWell-Known Security Files ExplainedWhat the /.well-known/ path is for, and how security.txt and the change-password URL convention both use it to make a site's own security posture machine-discoverable.5 min read

Related Tools