Security.txt Validator
Check security.txt fields, contacts, canonical URLs and expiration locally.
Validate security.txt locally
The validator checks required Contact and Expires fields plus common URI and date errors.
Deployment location, HTTPS behavior and digital signatures still need to be checked on the live website.
How to use the Security.txt Validator
- Provide the complete value or source material you want to inspect.
- Run the check and review each result or warning.
- Correct the original source and repeat the check before using it.
Practical example
Review the result against the needs of the specific website or account instead of treating a generated value as a complete security review.
What this tool cannot guarantee
A focused browser tool cannot replace layered security controls, current software, monitoring or a professional assessment.
Continue this workflow with the Security.txt Generator
Read the Website Security Headers Guide for implementation guidance and common limitations.
Frequently asked questions
Is the Security.txt Validator free to use?
Yes. It is available without an account or paid subscription.
Is my input uploaded or stored?
The core operation runs in your browser. Avoid pasting secrets into any web page unless the individual tool explicitly explains how the data is handled.
Should I review the result before using it?
Yes. Check the output for your project and test it in the intended environment before production use.