AdminForge Star on GitHub

security.txt validator

Server side

Check a domain's security.txt for RFC 9116 fields, expiry and HTTPS delivery

Input

The scheme is optional. Both the RFC 9116 and legacy root locations are checked.

This tool runs on the AdminForge server, which needs to reach the target you enter. Nothing is stored or logged. Do not paste secrets into a server-side tool on an instance you do not control.

Fill in the form and run the tool. Results appear here.

RFC 9116 requires security.txt at /.well-known/security.txt, with Contact and Expires fields. The legacy /security.txt location is still checked so older deployments get a useful migration finding.