Draft a valid RFC 9116 security.txt for your site in under a minute. Answer the questions, copy or download the file, deploy it to /.well-known/security.txt. No signup, nothing leaves your browser.
Key figure: Reported cybercrime losses in the United States reached $16.6 billion in 2024, up 33% from 2023 (FBI IC3, 2024 Internet Crime Report).
# Your security.txt will appear here
Contact, Expires (required), Encryption, Acknowledgments, Policy, Hiring, Preferred-Languages, Canonical. Comment lines start with #.Security.txt is cybersecurity news for defenders because it gives researchers a standard way to report vulnerabilities before attackers find them. The RFC 9116 file sits at /.well-known/security.txt with your contact details. Without it, well-meaning hackers have no safe channel — and may disclose your flaw publicly instead of privately.
https://yourdomain.com/.well-known/security.txt so it is served as plain text over HTTPS.Expires date and regenerate — an expired security.txt is treated as untrustworthy. Set a calendar reminder.security.txt is a plain text file defined by RFC 9116, published in April 2022. Placed at /.well-known/security.txt, it tells security researchers exactly how to report vulnerabilities they find in your systems — which contact to use, whether encrypted reports are accepted, and where your disclosure policy lives.
Two fields are required: Contact (at least one mailto:, https: or tel: URI) and Expires (an ISO 8601 date-time, recommended less than a year ahead so the file cannot go stale). Everything else — Encryption, Acknowledgments, Policy, Hiring, Preferred-Languages, Canonical — is optional but useful.
Upload it to https://yourdomain.com/.well-known/security.txt and make sure it is served as plain text over HTTPS. Most static hosts, CDNs and CMS platforms let you add a file at that path in minutes.
No. This generator runs entirely in your browser. Nothing you type is sent anywhere — the file is assembled locally and downloaded straight to your device.
A valid security.txt gives researchers a clear, private channel to report vulnerabilities they find in your systems — so flaws reach your team before attackers can exploit them into a data breach. Pair it with a disclosure policy and monitoring, and you shrink the window between discovery and fix.