FmindSecurity guide
Security contact file (security.txt)
If someone discovers a security problem on your website, a security.txt file tells them how to reach you. Without it, a helpful warning may never reach you or may go to the wrong person.
Who can help
Your web developer or website manager
Inspect before changing
Use these steps for a website or email domain you manage. Complete the capitalized placeholders with your own values. If a step refers to saved evidence, run the free check and verify your domain to open the private report. Use the exact hostname or DNS query name shown there.
- Use this template only if the file needs to change. Replace the contact with a monitored address approved for public use and the expiry with a future RFC 3339 date. Ask your web host how to serve this exact path as UTF-8 plain text; a CMS page returned as HTML won’t work.
Contact: mailto:OWNER_APPROVED_PUBLIC_ADDRESS
Expires: FUTURE_RFC3339_DATE
Canonical: https://YOUR_HOSTNAME/.well-known/security.txtWhat to do
Publish a plain-text file at /.well-known/security.txt on your HTTPS site. It needs a Contact: line with a monitored address (for example mailto:security@your-domain.example) and an Expires: line with a future date in RFC 3339 format (such as 2027-12-31T23:59:59Z). Set a reminder to update it before that date, and only list contact details you are happy to make public.
How to verify the change
Open https://your-domain/.well-known/security.txt in a browser: it should show the text file with your contact and a future date. Then run this check again. If you add a Canonical: line, it must include that exact address.
What this check can establish
We only read the file. We don’t send a message to the contact, check a PGP signature or test how you respond.