security.txt Generator

Free security.txt Generator (RFC 9116)

Create a valid security.txt file in seconds. Fill in your security contact, expiry date, and optional fields like encryption key, policy, and acknowledgments — then copy or download a standards-compliant file to publish at /.well-known/security.txt. Free, runs in your browser, no sign-up.

What is a security.txt file?

security.txt is a small text file, defined by RFC 9116, that tells security researchers how to report vulnerabilities they find on your site. Published at a well-known location, it removes the guesswork of finding the right contact, which means genuine issues reach you faster and through the channel you prefer. It has become a widely adopted best practice for organisations of every size.

How to use the generator

It takes a minute:

• Add one or more Contact lines (an email with mailto: or a reporting URL).
• Set the Expires date — when the file should be treated as stale.
• Optionally add an encryption key, disclosure policy, acknowledgments page, and preferred languages.
• Copy or download the file and upload it to your site.

The fields explained

Each directive has a clear purpose:

• Contact (required) — how to reach your security team; you can list several.
• Expires (required) — the date after which the file should not be trusted.
• Encryption — a URL to your PGP key so reports can be sent securely.
• Canonical — the official URL of this security.txt file.
• Policy — a link to your vulnerability disclosure policy.
• Acknowledgments — a page thanking researchers who have helped.
• Preferred-Languages and Hiring — languages you accept reports in, and a link to security jobs.

Where to publish security.txt

Upload the file to https://yourdomain.com/.well-known/security.txt, served over HTTPS. That well-known path is where researchers and automated tools look first. A copy at the site root (/security.txt) is permitted as a fallback for older setups, but the .well-known location is the standard and should always be present. Make sure the file is publicly readable and returns a 200 response.

Keep the Expires date current

RFC 9116 makes the Expires field mandatory so stale files are not trusted indefinitely. Set it a reasonable time in the future — many organisations use six months to a year — and put a reminder in place to regenerate the file before it lapses. An expired security.txt signals neglect and may be ignored by researchers and scanners, so treat renewal as routine maintenance.

Pro tip

If you sign your security.txt with PGP, host the signature and reference your key with the Encryption field so reporters can verify the file is authentic. Pair a clear Policy link with a monitored Contact inbox so reports do not sit unread. To also declare a security contact for browsers and scanners, this file works alongside your other security headers.

FAQ

Related tools

Pro tip: pair this tool with Robots.txt Exposure Checker and Cookie Security Checker for a faster SEO workflow.

• Robots.txt Exposure Checker — Find sensitive paths exposed in robots.txt like admin panels, backups, and databases.
• Cookie Security Checker — Analyze cookies for Secure, HttpOnly, and SameSite flags. GDPR compliance checker.
• XML-RPC Exposure Checker — Check if WordPress XML-RPC is exposed and assess attack surface risks.
• Mixed Content Checker — Detect insecure HTTP resources loaded on HTTPS pages that break browser security.
• Robots.txt Security Analyzer — Analyze robots.txt to detect exposed admin, login, and sensitive paths.