Email security

How to fix: security.txt file

security.txt is a small text file at /.well-known/security.txt that tells security researchers how to report a vulnerability to you (RFC 9116).

Not sure whether your site has this problem? Check it in seconds.

security.txt checker Run a free audit

Why it matters

Without a published contact, someone who finds a flaw may not know who to tell, or may give up. It's a signal that you take reports seriously, and it costs nothing.

How to check

Open https://yourdomain.com/.well-known/security.txt in a browser. It should return plain text with a 200 status.

How to fix it

Template

Contact: mailto:security@yourdomain.com
Expires: 2027-12-31T23:59:59.000Z
Preferred-Languages: en
Canonical: https://yourdomain.com/.well-known/security.txt

Next.js

Save the file as public/.well-known/security.txt (create the .well-known folder inside public).

Common mistakes

Letting the Expires date pass: an expired file is treated as stale. Set a reminder to renew it.
Pointing Contact at a mailbox nobody reads.

Frequently asked questions

Which fields are required?

Contact and Expires. The rest are optional.

Related guides

Guidance is general. Test header and DNS changes on a staging copy first, and check your hosting provider's documentation for platform-specific steps.