Is my security.txt file missing or expired?

Updated 2026-10-17

Short answer: security.txt (at /.well-known/security.txt) tells people who find a security problem how to report it to you. The standard requires an Expires date, and an expired file tells reporters it's no longer looked after.

How to check it yourself

  1. Visit /.well-known/security.txt on your domain.
  2. Check it has a Contact line you actually read and an Expires date in the future.
  3. If it's missing or expired, create or update it with a Contact (an email or form) and an Expires date within a year.
  4. Set a reminder to renew it before it expires.

Why it matters

A security.txt file at /.well-known/security.txt tells researchers who find a problem on your site how to report it to you. If it's missing, a well-meaning report may never reach you. The file must include an Expires date, and once that date passes, the file is meant to be treated as out of date.

Common causes

  • The file was created once with an Expires date a year out, and nobody renewed it.
  • The contact email in it no longer exists.
  • The site was rebuilt and the .well-known folder wasn't carried over.
  • It was never added at all.

What Preventionlabs shows

Every report's site files check looks for security.txt and whether it has expired, alongside robots.txt (including which AI crawlers it blocks), llms.txt and ads.txt. For example, from a real report: "No security.txt, so someone who finds a security hole on your site has no listed way to tell you."

Price

First report free, no card needed. Then A$50 a month, up to 10 domains.

Run your first report free