security.txt Checker
Checks whether you publish a security.txt file (RFC 9116) so researchers can report vulnerabilities.
What it checks
This checker looks at whether you publish a security.txt file following the RFC 9116 standard. That file tells security researchers how to report a problem they find. The scanner only verifies whether it exists and is reachable.
Why it matters
Without security.txt, someone who discovers a flaw in your site may not know whom to notify and could disclose it publicly or ignore it. Having it enables responsible disclosure and signals security maturity. It is not mandatory, but it is an increasingly expected good practice.
How to fix it
Create a text file at /.well-known/security.txt with at least a contact field, such as an email or a form. Also add the expiration date the standard requires. It is a simple static file you can deploy alongside the rest of your site.
Check it on your site
Scan your site free and see if this and 44 other checks pass, with a fix prompt for every issue.
Scan my site free