WebsiteScanner
Full website scanTiếng Việt

security.txt generator

Fill in your security contact details and get a ready-made security.txt file following RFC 9116. Everything runs in your browser; nothing is sent anywhere.

Contact — email or https URL, at least one required

Your security.txt

How to publish the file

  1. Location: Serve the file at https://your-domain/.well-known/security.txt, over HTTPS, as text/plain.
  2. Nginx: Add inside server { ... }, then run nginx -t && systemctl reload nginx:
    location = /.well-known/security.txt {
  root /var/www/html;
  default_type text/plain;
}
  3. Apache: Just put the file in a .well-known folder in your web root. Make sure no .htaccess rule blocks the .well-known directory (Apache serves .txt as text/plain).
  4. WordPress: Upload the file to a .well-known folder in the site root using your host's file manager (e.g. cPanel File Manager) or FTP. Plugins exist for this too, but placing the file directly is simplest.
  5. Cloudflare Workers / Pages: Put the file at public/.well-known/security.txt (your static assets folder) and redeploy.

The standard allows signing the file with PGP (OpenPGP cleartext signature); this tool does not cover signing.

What is security.txt for?

security.txt is a small text file that tells security researchers whom to contact when they find a vulnerability on your website. Without it, people who want to report a problem in good faith often can't find a channel, and the issue may go unreported or be disclosed publicly.

In WebsiteScanner reports, a missing security.txt is only a suggestion (informational) and does not lower your score.

FAQ

Is security.txt mandatory?

No. It is a voluntary standard (RFC 9116). It helps people who find vulnerabilities reach you, but WebsiteScanner only lists a missing file as a suggestion and does not deduct points.

Which fields are required?

Under RFC 9116, Contact and Expires are required. Other fields such as Preferred-Languages, Policy and Canonical are optional but recommended.

Why should Expires be less than a year away?

So the contact details don't go stale. RFC 9116 recommends an Expires value less than a year in the future, and updating the file before that date.

Should Contact be an email or a web address?

Either works. An email (mailto:) is simplest; if you have a dedicated reporting page or form, use its https URL. You can list several Contact lines in order of preference.

Check your whole website's security for free

Beyond security.txt, WebsiteScanner checks SSL, security headers, SPF/DMARC, exposed sensitive files and more, with an A–F grade and fixes.

Free scan