A security.txt file is a standard file placed on your website that tells security researchers how to responsibly report a vulnerability they discover on your site.
Why this matters
An expired security.txt is treated as invalid under the official standard (RFC 9116). It signals to researchers that the contact information may be out of date, making it less likely that genuine vulnerability reports reach you.
How to fix it
Update the Expires field in your security.txt file to a future date, and confirm the contact address listed is still actively monitored.
Turn website findings into an action plan
Create an account to start a Full Audit of your website, with supporting evidence and a prioritised action plan.