Use an RFC 3339 date in the Expires line
Why it matters
Expires must be a full date and time such as 2027-06-30T23:59:59Z, and a value that cannot be read is treated as missing. Tools then cannot tell whether the file is still current.
The fix
- Replace the value with a date and time in the form year-month-dayThour:minute:second followed by Z for UTC or an offset such as +02:00. A date alone, or a format like 30/06/2027, is not valid.
- Keep a single Expires line, set less than a year ahead.
text
Expires: 2026-12-31T23:59:59Z Related
- Reported by the security.txt check
- Publish a security.txt file
- Serve security.txt from /.well-known/
- Serve security.txt over https
- Serve security.txt as text/plain with utf-8
- Add a Contact line to security.txt
- Fix the Contact value in security.txt
- Add an Expires line to security.txt
- Renew the expired security.txt
- Renew security.txt before it expires
- Shorten the security.txt Expires date
- Fix repeated or insecure fields in security.txt
- Make the Canonical line match where the file is served
Scan your domain to see whether this applies to you.