security.txt checker

Check a security.txt file against RFC 9116: required fields, an expired Expires date, and recommended Canonical and Encryption lines.

security.txt checker reads an RFC 9116 file and lists every Contact and Expires field found, flagging an Expires date that has passed or cannot be parsed. It notes whether Canonical, Encryption and Policy, recommended but optional, showed up. A missing Contact or Expires field is marked as that problem; more than one Expires field is also flagged.

Questions

Which fields are required?

Contact and Expires; either missing is flagged as a specific problem.

What happens with an expired date?

It is flagged as EXPIRED with the number of days since it passed.

What happens with more than one Expires field?

It is flagged, since RFC 9116 requires exactly one.

What fields are recommended but optional?

Canonical, Encryption and Policy; their absence is noted but does not count as a problem.

What comment style does the parser recognise?

Lines starting with #, which are skipped, per RFC 9116's field syntax.

Related Security tools

·→1CVSS calculatorParse a CVSS 3.1 or 4.0 vector string and compute its base score and severity, on your device. 3.1 matches the published formula exactly; 4.0 approximates FIRST's severity table.·→1CSP evaluatorCheck a Content-Security-Policy header for unsafe-inline/eval, wildcard sources, and missing default-src, object-src, or base-uri.·→1SPF / DMARC / DKIM record parserBreak an SPF, DMARC, or DKIM TXT record into its mechanisms or tags, on your device, with weak-configuration warnings.·→1Set-Cookie header parserBreak one or more Set-Cookie header lines into name, attributes, and flags, on your device, with common misconfiguration warnings.·→1URL unfurlBreak a URL into its scheme, punycode-decoded host, and query parameters, on your device, decoding base64-looking values and nested redirect URLs.·→1PKCE code verifier and challengeGenerate an OAuth 2.0 PKCE code verifier and its S256 code challenge, on your device, for an authorization code flow.·→1Webhook HMAC signature verifyCheck a webhook payload against its HMAC signature, on your device, including Stripe and GitHub header formats.