Generate a security.txt file researchers can actually find

What is security.txt, and why does every website need one?

Security researchers who stumble on a vulnerability often face an unexpected obstacle: finding out who to tell. Without a clear reporting channel, a well-intentioned report can bounce between a generic support inbox, an outdated contact form, or nobody at all. Security.txt solves that problem by putting a machine-readable, human-friendly file at a predictable location on every domain, so anyone who discovers a security issue knows exactly where to look and how to reach the right team.

The format is defined by RFC 9116, published by the IETF in April 2022, which standardizes where the file lives, what it contains, and how it should be structured. The convention is simple: place a plain text file at https://yourdomain.com/.well-known/security.txt. Some site owners also mirror it at the domain root as a fallback, though the well-known path is the canonical location scanners and researchers check first.

A well-known security.txt example typically includes a handful of core directives. Contact is mandatory and can appear multiple times — an email address prefixed with mailto:, a web form URL, or even a phone number. Expires is also mandatory, and tells anyone reading the file when it should be considered stale; RFC 9116 recommends refreshing it at least annually so contact information never goes silently out of date. Optional fields round out the picture: Encryption points to a PGP key for secure communication, Acknowledgments links to a page crediting researchers who have reported issues responsibly, Policy links to your formal vulnerability disclosure policy, Hiring is a nice touch for security teams recruiting talent, and Preferred-Languages tells researchers which languages your team can respond in.

So how to actually create one correctly? Manually writing the file is easy to get wrong — a missing colon, an unfolded long line, or fields listed out of the specification's preferred order can cause automated scanners to misparse it. That is exactly the gap this generator closes: fill in your contact details, expiry date, and any optional directives, and receive a properly formatted file with correct field ordering, valid URI syntax, and RFC-compliant structure, ready to copy or download.

Beyond compliance, publishing a security.txt file signals maturity. It tells researchers, auditors, and even automated security-rating services that your organization takes vulnerability disclosure seriously and has a defined process rather than an ad-hoc one. Combined with a documented disclosure policy and a monitored contact address, it is one of the simplest, lowest-cost improvements a website can make to its overall security posture — and, thanks to RFC 9116, one of the easiest to get exactly right.