WHAT THE TEST CHECKS
The checker tests the standard location, can fall back to /security.txt, and evaluates whether a usable Contact field is present. When available, it also shows information such as the expiry date.
SECURITY SIGNAL
security.txt Checker
Check the standard security.txt location and whether it publishes a Contact field.
VULNERABILITY DISCLOSURE
What the security.txt checker tells you
security.txt is a standardized public file that gives security researchers a clear way to contact the organization when they discover a vulnerability. The preferred location is /.well-known/security.txt and the file should provide at least a valid Contact field.
IMPACT ON THE COMPANY
The absence of security.txt does not by itself mean that a website is insecure. It can, however, slow down responsible disclosure because a researcher may not know where to report a problem or whether the report will reach the right people.
WHY IT MATTERS
A clear security contact improves incident readiness, shortens the path between discovery and remediation and signals that the company takes coordinated vulnerability disclosure seriously.
iThe checker requests only public website locations and does not attempt to exploit or penetrate the tested website.
This is only one part of the digital footprint.
Run the complete Webitech assessment to see the wider technical, trust, content, data, social and AI context.
Run complete Webitech Audit →