Your details
One per line: an email address, an https:// link to a form or a phone number. Most preferred first.
RFC 9116 recommends less than a year, so the file gets reviewed.
security.txt
What security.txt is for
When someone finds a vulnerability on your site, they need to know who to tell. security.txt is a small text file at a standard address, /.well-known/security.txt, that answers that question. It’s defined in RFC 9116, and security researchers, scanners and bug-bounty platforms check for it. Without one, reports often go to a general inbox, a social media account, or nowhere.
The fields
- Contact (required): how to reach you. An email address becomes a
mailto:link; you can list several, most preferred first. - Expires (required): the date after which the file should no longer be trusted. Keep it under a year away and update it before it passes.
- Policy: a page explaining what you consider in scope, how you respond, and whether you reward reports.
- Canonical: the file’s own address, so copies served elsewhere can be spotted.
- Encryption, Acknowledgments, Preferred-Languages and Hiring are optional.
Serving the file
Save it as .well-known/security.txt in your site’s document root. On WordPress that’s the folder that holds wp-config.php; on Laravel it’s public/. Nginx and Apache serve it as a normal static file. If your Nginx config blocks hidden folders, make sure the rule allows .well-known, as the Nginx Config Generator’s config does: location ~ /\.(?!well-known).*. Then open https://your-domain/.well-known/security.txt to check it’s served as plain text.
You can also sign the file with OpenPGP so readers can verify it came from you; the checker above accepts signed files. Everything on this page runs in your browser.