Webforta
Sign inStart free trial
Free tool

security.txt generator

Create a valid security.txt file so security researchers know how to report a vulnerability in your website - and where to send it.

Optional. Used to fill in the Canonical URL.

One per line, most preferred first: mailto:security@example.com, an https:// page or form, or tel:+15551234567. A plain email address is turned into mailto:.

Required. Defaults to one year from today; RFC 9116 recommends less than a year. Written as ISO 8601 UTC.

Optional. Link to your OpenPGP public key.

Optional. Page thanking researchers who reported issues.

Optional. Comma-separated language tags, for example en, de, pt-BR.

Optional. One https:// URL per line where this file is published. Left empty, it becomes https://<your domain>/.well-known/security.txt when the domain is filled in.

Optional. Your vulnerability disclosure policy.

Optional. Security-related job openings.

Optional. Your CSAF provider-metadata.json, if you publish security advisories.

Your entries are not stored. With JavaScript on, the file is generated in your browser and nothing is sent to Webforta.

What is security.txt?

RFC 9116 defines a small text file that tells people who find a security problem in your website how to contact you. Without it, a researcher may not find the right address and the report can end up in a general inbox, on social media, or nowhere at all.

Where it goes

Publish it at https://your-domain/.well-known/security.txt (a copy at /security.txt is optional). It must be served over HTTPS with the text/plain content type.

Required fields

  • Contact - at least one way to reach you. List the preferred one first.
  • Expires - when the file should no longer be trusted, so stale contacts are not used forever.

Sign it (optional)

RFC 9116 recommends signing the file with an OpenPGP cleartext signature so readers can check it has not been tampered with. This tool does not sign anything: sign the downloaded file yourself, for example with gpg --clearsign security.txt, and include a Canonical URL when you do.

Check your site's security.txt with a free Webforta scan

A Webforta scan checks whether your security.txt is published, valid and not expired, alongside HTTPS, security headers and exposed files on websites you verify.

Start a free scanAbout the scanner