A security.txt file past its Expires date is stale, and researchers are told not to use it. Set the date less than a year ahead, put a renewal reminder in a calendar, sign the file if you can, and serve it from the right host over HTTPS as plain text.
The two required fields
RFC 9116 requires Contact, at least once, and Expires, exactly once. Contact values use schemes such as mailto, tel or https, and the first is the most preferred. Expires is a date and time in an RFC 3339 profile of ISO 8601.
The RFC recommends the date be less than a year in the future, and says data past its Expires time is stale and should not be used. Short expiry is deliberate. It stops an abandoned file pointing at a dead mailbox for years.
Keeping it fresh
The failure mode is not a bad file, it is a good one nobody renews. Two habits fix that:
- Put the renewal in a recurring calendar task or ticket owned by a role, not a person.
- Check the file in your regular release or compliance checklist.
If you manage many domains, generate the file from a template with the date computed at deploy time, then monitor that the deployed copy has at least a few months left.
Signing
The RFC recommends an OpenPGP cleartext signature. If you sign, it also recommends the Canonical field, so the signature covers the location of the file. Researchers decide whether to trust the signing key, and an Encryption key is not assumed to be the signing key.
Serving it correctly
- Preferred path: /.well-known/security.txt. A top-level /security.txt is allowed for legacy use, and if both exist the well-known one wins.
- Serve over https.
- Content type text/plain with charset utf-8.
- The file applies only to the exact host in its URI. It does not cover subdomains or parent domains, so publish one per host that matters.
Format details
One field per line, name then colon then value. Names are case-insensitive. Lines starting with the hash sign are comments. Unknown fields are allowed and should be ignored. The RFC suggests parsers may reject very large input, for example above 32 KB per file, 2,048 characters per field or 1,000 lines, so keep it small.
For a walkthrough of the useful optional fields, see how to write and publish security.txt.
Quick check
What happens if Expires passes?
The data is considered stale and should not be used. Researchers may fall back to other ways of finding you, or give up.
Does one file cover my whole company?
No. It applies only to the host it is served from.
Sources
- IETF: RFC 9116, security.txt
Last reviewed: 19 October 2026.
