Observed arrival · 2026-09-04
IndieSecurityTXT checks your security.txt against RFC 9116
A free, no-account validator that fetches a domain’s security.txt and checks its location, format, required fields, redirects, and optional signature.
Field notes
The tool makes one HTTPS request to the checked domain’s /.well-known/security.txt and evaluates the response against named RFC 9116 sections. Its checklist includes media type, redirects, UTF-8 field formatting, Contact, Expires, Canonical, and OpenPGP signature handling, while the companion copy action produces a file intended for publication as text/plain; charset=utf-8. The homepage also states that checks remain private and that the core service has no account or premium tier.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
One card from the complete issue