How to use the security.txt Generator
- Enter at least one Contact — an email, a URL to a reporting form, or a phone number.
- Set an Expires date (less than a year ahead is recommended) and add optional fields such as your disclosure policy and PGP key.
- Download the file and upload it so it’s served at
https://yourdomain.com/.well-known/security.txt. - Put a reminder in your calendar to update it before it expires.
What is security.txt?
security.txt is a small plain-text file, standardised as RFC 9116 in 2022, that tells security researchers how to contact you when they find a vulnerability on your site. Without one, well-meaning people often give up or end up emailing a generic support address where reports get lost. It’s the security equivalent of robots.txt — and it’s required or recommended by a growing number of government and enterprise security guidelines.
Fields explained
| Field | Required? | Purpose |
|---|---|---|
| Contact | Yes (one or more) | Where to send reports: mailto:, https: or tel:. |
| Expires | Yes (exactly one) | When the information should be considered stale — ISO 8601 date-time. |
| Policy | No | Link to your vulnerability disclosure policy. |
| Encryption | No | Link to a PGP key for encrypted reports. |
| Acknowledgments | No | Page thanking researchers (hall of fame). |
| Preferred-Languages | No | Languages your team reads, e.g. en, de. |
| Canonical | No | The file’s own URL(s), useful when it’s signed. |
| Hiring / CSAF | No | Security job listings / machine-readable advisories. |
Where to put the file
Serve it over HTTPS at /.well-known/security.txt with the text/plain content type. Hosting platforms differ: on most servers you simply upload the file; on hosted site builders you may need a redirect or a reverse proxy because custom files in /.well-known/ aren’t always supported. Optionally, sign the file with PGP (cleartext signature) so readers can verify it hasn’t been tampered with.
Tools that pair well with the security.txt Generator
- llms.txt Generator — Write an llms.txt file that gives AI assistants a curated, Markdown map of your site — project name, summary, key pages and optional extras — following the llmstxt.org proposal.
- humans.txt Generator — Create a humans.txt that credits the team, contributors and technology behind your website.
- Security Headers Checker — Grade a site’s HTTP security headers from A+ to F, see which are missing and why they matter, and copy ready-made config snippets for Nginx, Apache, Netlify, Vercel or Cloudflare.
- ads.txt Generator — Build an IAB-compliant ads.txt that lists who is allowed to sell your ad inventory — with presets for common ad networks.
Frequently asked questions
Is security.txt an official standard?
Where should security.txt be located?
https://yourdomain.com/.well-known/security.txt. A copy at /security.txt is allowed for legacy compatibility but the .well-known path is the standard location.