What security.txt is for
When someone finds a flaw on your website, they need to know who to tell. A security.txt file at /.well-known/security.txt gives them a contact address and your reporting rules, so problems reach you instead of being sold or posted publicly.
It is defined in RFC 9116 and takes five minutes to set up.
Frequently asked questions
Does every website need a security.txt?
It is optional but recommended, especially for sites that collect personal data or take payments.
Why does the file have an expiry date?
So that an old file with a dead contact address stops being trusted. Renew it at least once a year.
Should I sign the file?
Signing with PGP is optional. It lets researchers verify the file came from you.
Read-only: we request public pages the way a visitor would. Private and internal addresses are blocked, and nothing you enter is stored.
Want this running on every page, every day?
UrKavach monitors security, uptime, speed and SEO for every website you manage.