Security.txt checker
Checks a site's security.txt against RFC 9116 - location, required fields, duplicates, expiry, and canonical consistency.
1 · Input
What is checked
Whether /.well-known/security.txt exists (the location RFC 9116 requires), falling back to the legacy /security.txt only to report that a site is relying on the deprecated location. Delivery over HTTPS, content type, the required Contact and Expires fields, duplicate values for fields that must appear only once, an expired file, and whether a declared Canonical field actually matches the URL the file was found at.
Nothing is contacted
This only parses and validates the file's own structure - it never sends anything to the Contact address a site has published for security researchers.
.webp)
Rate this tool
Was this tool useful? Your feedback helps us improve it.