# security.txt Checker | Build files that test RFC 9116 handling

Build or paste authorized security.txt fixtures to exercise contact, expiry, canonical URL, media type and publishing failures, then review a corrected draft.

Canonical: https://tamperbox.dev/security-txt-checker

Docs: https://docs.tamperbox.dev/tools/security-txt-checker.md

Updated: 2026-10-26

Reviewed: 2026-10-17

## How it works

Enter a host name and our server requests `https://host/.well-known/security.txt` once, follows up to five HTTPS redirects and reads at most 64 KiB; paste a file and it is read in your browser. The file is checked against RFC 9116 and shown the way a researcher reads it: where to report, which key and policy apply, and when it expires, with problem lines marked and a corrected file to publish.

The full method, every rule and worked examples are on [docs.tamperbox.dev](https://docs.tamperbox.dev/tools/security-txt-checker/).

## Limits and interpretation

Only `/.well-known/security.txt` is requested, not the legacy `/security.txt` location. A PGP signature is recognised and separated from the file, but not verified. A valid file shows that the format is right; it does not show that anyone reads the Contact mailbox, who controls it, or that testing is permitted. A missing Expires, an expired date, an `http://` web address or a Canonical that names another address makes the file invalid; an Expires more than a year ahead is only a recommendation. A pasted file has no media type, redirects or fetch address, so those checks need a live lookup. The live default is fetched when the page opens and its findings can change when the site edits its file. Nothing is stored.

## Frequently asked questions

### Where should security.txt be published?

At `https://your-host/.well-known/security.txt`, served as `text/plain; charset=utf-8`. This checker requests only that location and reports its status, media type and content.

### Why is an Expires date years ahead only a warning?

RFC 9116 requires an Expires field and recommends a date less than a year ahead, so a later date is valid but lets stale contacts survive unnoticed. An Expires in the past makes the file invalid.

### Does a valid security.txt authorize penetration testing?

No. It provides contact and policy information. Read the linked policy and obtain any required authorization separately.

## References

[security.txt: RFC 9116, section 2](https://www.rfc-editor.org/rfc/rfc9116#section-2) for fields and [section 3](https://www.rfc-editor.org/rfc/rfc9116#section-3) for location · [Date and time format: RFC 3339, section 5.6](https://www.rfc-editor.org/rfc/rfc3339#section-5.6) · [Language tags: RFC 5646](https://www.rfc-editor.org/rfc/rfc5646) · [OpenPGP cleartext signatures: RFC 9580, section 7](https://www.rfc-editor.org/rfc/rfc9580#section-7).