Fix the Contact value in security.txt
Why it matters
RFC 9116 allows a Contact only as a mailto:, tel: or https:// address, so a bare email address or an http link is not valid. Tools that read the file may skip such a line.
The fix
- Rewrite each Contact line as a URI. An email address becomes mailto:address, a phone number becomes tel:+countrycode..., and a web form must use https://.
- Check the file again at https://example.com/.well-known/security.txt.
text
Contact: mailto:[email protected] Contact: tel:+1-201-555-0123 Contact: https://example.com/security-report
The examples use example.com. Replace it with your own domain.
Related
- Reported by the security.txt check
- Publish a security.txt file
- Serve security.txt from /.well-known/
- Serve security.txt over https
- Serve security.txt as text/plain with utf-8
- Add a Contact line to security.txt
- Add an Expires line to security.txt
- Use an RFC 3339 date in the Expires line
- Renew the expired security.txt
- Renew security.txt before it expires
- Shorten the security.txt Expires date
- Fix repeated or insecure fields in security.txt
- Make the Canonical line match where the file is served
Scan your domain to see whether this applies to you.