Fix repeated or insecure fields in security.txt

Why it matters

Expires and Preferred-Languages may appear only once, and links to your policy, encryption key or acknowledgements page must use https. A file that breaks these rules can be rejected or misread by tools.

The fix

1. Keep a single Expires line and a single Preferred-Languages line. Join several languages in one line, separated by commas.
2. Change every web link (Policy, Encryption, Acknowledgments, Hiring, Canonical, and web Contact values) from http:// to https://.

Contact: mailto:security@example.com
Expires: 2026-12-31T23:59:59Z
Preferred-Languages: en, de
Policy: https://example.com/security-policy

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the security.txt check
• Publish a security.txt file
• Serve security.txt from /.well-known/
• Serve security.txt over https
• Serve security.txt as text/plain with utf-8
• Add a Contact line to security.txt
• Fix the Contact value in security.txt
• Add an Expires line to security.txt
• Use an RFC 3339 date in the Expires line
• Renew the expired security.txt
• Renew security.txt before it expires
• Shorten the security.txt Expires date
• Make the Canonical line match where the file is served