Tous les guides

Ces guides de correction sont rédigés en anglais.

Security.txt

Cette vérification représente 6 % du score.

How to create a security.txt file per RFC 9116: the missing file, required fields, expired dates, and optional fields.

security.txt not found

Create /.well-known/security.txt with at minimum the two required fields:

Contact: mailto:security@your-site.com
Expires: 2027-12-31T23:59:59.000Z

# Optional but recommended
Canonical: https://your-site.com/.well-known/security.txt
Preferred-Languages: en
Policy: https://your-site.com/security-policy
Generator
Use securitytxt.org for an interactive generator, or run npx ax-init and select "security.txt".

Required field missing

RFC 9116 requires two fields:

  • Contact:, a mailto: or https: URI for security reports (e.g., Contact: mailto:security@your-site.com)
  • Expires:, an ISO 8601 date when the file should be considered stale (e.g., Expires: 2027-12-31T23:59:59.000Z)

Add the missing field(s) to your security.txt. The Expires date should be no more than 1 year in the future; set a calendar reminder to update it before it expires.

Expired security.txt

Your security.txt's Expires date is in the past. This means the file is technically stale and should not be trusted.

Update the Expires: field to a future date. A common practice is setting it 6-12 months ahead:

Expires: 2027-06-30T23:59:59.000Z

Missing optional fields

While not required, these optional fields provide additional context:

  • Canonical:, the canonical URL of this security.txt file
  • Preferred-Languages:, languages you accept for security reports (e.g., en)
  • Policy:, link to your security disclosure policy
  • Encryption:, PGP key for encrypted reports
  • Hiring:, link to security job openings