# Security.txt

> How to create a security.txt file per RFC 9116: the missing file, required fields, expired dates, and optional fields.

Esta comprobación representa el 3% de la puntuación.

*Estas guías de corrección están escritas en inglés.*

<a id="not-found"></a>

## security.txt not found

Create `/.well-known/security.txt` with at minimum the two required fields:

```
Contact: mailto:security@your-site.com
Expires: 2027-12-31T23:59:59.000Z

# Optional but recommended
Canonical: https://your-site.com/.well-known/security.txt
Preferred-Languages: en
Policy: https://your-site.com/security-policy
```

> **Generator**
>
> Use
>
> securitytxt.org
>
>  for an interactive generator, or run
>
> npx ax-init
>
>  and select "security.txt".

---

<a id="missing-field"></a>

## Required field missing

RFC 9116 requires two fields:

- `Contact:`, a mailto: or https: URI for security reports (e.g., `Contact: mailto:security@your-site.com`)
- `Expires:`, an ISO 8601 date when the file should be considered stale (e.g., `Expires: 2027-12-31T23:59:59.000Z`)

Add the missing field(s) to your security.txt. The Expires date should be no more than 1 year in the future; set a calendar reminder to update it before it expires.

---

<a id="expired"></a>

## Expired security.txt

Your security.txt's Expires date is in the past. This means the file is technically stale and should not be trusted.

Update the `Expires:` field to a future date. A common practice is setting it 6-12 months ahead:

```
Expires: 2027-06-30T23:59:59.000Z
```

---

<a id="missing-optional"></a>

## Missing optional fields

While not required, these optional fields provide additional context:

- `Canonical:`, the canonical URL of this security.txt file
- `Preferred-Languages:`, languages you accept for security reports (e.g., `en`)
- `Policy:`, link to your security disclosure policy
- `Encryption:`, PGP key for encrypted reports
- `Hiring:`, link to security job openings

---

Representación en Markdown de https://axrush.com/guides/security-txt