Write your security.txt

Fill in the contact and the date; the rest is optional and explained as you go. Nothing you type leaves your browser. When it is live, check it.

Your domain

Used for the Canonical: line, which lets a reader confirm the copy they have is yours.

Contact (required)

An email address becomes mailto:, a phone number tel:, a URL https:. Use a role address such as security@ that outlives any one person. List the most preferred first.

Another contact (optional)

Expires (required)

Less than a year away, so the file gets reviewed. Put the refresh in the calendar now.

Encryption key (optional)

Where your PGP public key is published, so researchers can encrypt details to you. openpgp4fpr:<fingerprint> also works.

Disclosure policy URL (optional)

What you promise researchers: scope, safe harbour, how long you take to reply.

Acknowledgments page (optional)

Security jobs page (optional)

Preferred languages

Include the explanatory comment lines

Your security.txt

# security.txt for your domain — see https://securitytxt.org and RFC 9116
# Generated with https://www.cyber-defence.io/tools/security-txt/generate

Expires: 2027-09-24T00:00:00.000Z
Preferred-Languages: en

At least one Contact is required.

Then

Put the file at /.well-known/security.txt on your domain, served over HTTPS as text/plain; charset=utf-8. On Apache: place it in .well-known/ under the document root, or Alias /.well-known/security.txt /var/www/security.txt; on nginx: location = /.well-known/security.txt { default_type text/plain; alias /var/www/security.txt; }.
Optionally sign it: gpg --clearsign security.txt and publish the .asc output as the file itself, with the public key at the Encryption: URL.
Make sure the contact mailbox is read by more than one person, and diarise the Expires date.
Check it with the security.txt checker once it is live.