Free security tool
See whether a website tells security researchers how to reach it, and whether its security.txt file is valid and still current under RFC 9116.
Instant result, no email needed.
The file is read over verified HTTPS from /.well-known/security.txt, or the legacy /security.txt. The required fields (at least one Contact and exactly one Expires in ISO 8601 format) are checked, as are the expiry date, Canonical URL, text/plain content type and PGP signature. If the site cannot be read, the page gives the reason rather than calling the file missing.
For the response headers of the same site, use the Security Headers Checker.
A small text file at /.well-known/security.txt, standardised in RFC 9116, that tells people who find a vulnerability where and how to report it.
At least one Contact (a mailto:, https: or tel: URI) and exactly one Expires date. Policy, Encryption, Acknowledgments, Preferred-Languages, Canonical and Hiring are optional.
Less than a year is recommended, so that someone re-checks that the contacts still work. An expired file should be treated as stale.
Optional. A PGP-signed file lets researchers verify it was not altered; if you sign it, include a Canonical field with the file's URL.
Add your domain to CloudSpex to monitor its security setup continuously.
Start Monitoring Free