Add a Contact line to security.txt

Why it matters

Contact is the one field that makes the file useful, because it says where to send a report. Without it the file is invalid under RFC 9116.

The fix

1. Add a Contact line with a mailbox, a phone number or an https address of a reporting form, using the mailto:, tel: or https:// forms. You can add several lines, most preferred first.
2. Make sure the mailbox exists and is read, then check the file again at https://example.com/.well-known/security.txt.

Contact: mailto:security@example.com
Contact: https://example.com/security-report

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the security.txt check
• Publish a security.txt file
• Serve security.txt from /.well-known/
• Serve security.txt over https
• Serve security.txt as text/plain with utf-8
• Fix the Contact value in security.txt
• Add an Expires line to security.txt
• Use an RFC 3339 date in the Expires line
• Renew the expired security.txt
• Renew security.txt before it expires
• Shorten the security.txt Expires date
• Fix repeated or insecure fields in security.txt
• Make the Canonical line match where the file is served