Validate your security.txt
Paste the file or enter its URL to check against RFC 9116.
Results update as you type.
Use the API
Validate security.txt from your scripts or CI. No API key required.
Examples and limits
Send JSON with either url or text to POST /api/validate.
URL request
curl 'https://securitytxts.com/api/validate' \
-H 'Content-Type: application/json' \
-d '{"url":"https://example.com/.well-known/security.txt"}'
Replace example.com with your domain.
Text request
curl 'https://securitytxts.com/api/validate' \
-H 'Content-Type: application/json' \
-d '{"text":"Contact: mailto:security@example.com\nExpires: 2027-04-14T00:00:00Z\n"}'
Response excerpt
{
"valid": true,
"errors": [],
"warnings": [],
"infos": []
}
Check valid for pass or fail. HTTP 200 means the request was processed. infos contains recommendations.
- Rate limit: one request every two seconds; bursts up to five. On HTTP 429, wait the number of seconds in
Retry-After. - URL limits: public HTTPS URLs, plain text, up to 64 KiB and five redirects.
- Request errors: treat non-2xx responses as failures. Error bodies may be JSON or plain text.
What is security.txt?
A file that tells researchers how to report security vulnerabilities.
Publish at this URL
https://example.com/.well-known/security.txt
Replace example.com with your domain. Serve UTF-8 plain text over HTTPS.
- Contact (required). Use an email address or URL that your team monitors.
- Expires (required). Set a future date, preferably less than a year away. Renew before it expires.
- Policy (optional). Link your disclosure policy and testing rules.
Top 150 domains
Source: Moz
Updated 15 Oct 2026
Signed — about this signature
A signature is present. This validator does not verify it.
Signed — about this signature
A signature is present. This validator does not verify it.
No matching domains. Try another name or clear the search.
No matching domains. Try another name or clear the search.