Add an Expires line to security.txt

Why it matters

Expires is required by RFC 9116 so that an old file with a mailbox nobody reads is not trusted forever. Without it the file is invalid.

The fix

1. Add one Expires line with a date and time in the format of RFC 3339, set less than a year ahead. The example date is only a placeholder; use your own.
2. Put a renewal reminder in your calendar so the file never expires unnoticed.

Expires: 2026-12-31T23:59:59Z

Read the documentation ↗(opens in a new tab)

Related

• Reported by the security.txt check
• Publish a security.txt file
• Serve security.txt from /.well-known/
• Serve security.txt over https
• Serve security.txt as text/plain with utf-8
• Add a Contact line to security.txt
• Fix the Contact value in security.txt
• Use an RFC 3339 date in the Expires line
• Renew the expired security.txt
• Renew security.txt before it expires
• Shorten the security.txt Expires date
• Fix repeated or insecure fields in security.txt
• Make the Canonical line match where the file is served