Your security.txt, checked every day
A security.txt goes stale silently: the expiry date passes, a key expires, after a relaunch the file is gone. Checking services then treat it as invalid, and anyone who wants to report a vulnerability finds no contact. We check it daily and tell you in time.
60 EUR per year per domain, excl. VAT
That is EUR 5 per month. Billed annually in advance, cancel any time for the end of the term. Businesses only.
- Daily check with the same rules as the checker, under RFC 9116 or BSI TR-03183-3
- Reminders 30, 14, 7 and 1 day before the file expires
- Reminder before a key from the file expires
- Alert as soon as the file is missing, the signature does not match or a link is dead, and when everything is fine again
- Check report every three months as evidence of the quarterly review under TR 4.2.9 c
- Up to 10 domains per subscription, changeable at any time
How monitoring works
- Order
Enter domains, choose the standard, pay. You receive a confirmation with your link to manage everything.
- First report
Within an hour we check every domain and send you the result with all findings and how to fix them.
- After that only when needed
We check again once a day. You only get an e-mail on changes, before an expiry and every three months as a report.
Frequently asked questions
What exactly is checked?
The same as the free checker: retrieval over HTTPS, structure, required fields, expiry date, Canonical, reachable links, mail domains, keys and the OpenPGP signature. With the BSI TR-03183-3 standard, also the rules of the technical guideline.
How often do you check?
Once a day per domain. If a file suddenly disappears, we check again an hour later before notifying you, so that a brief outage does not cause a false alarm.
Who receives the e-mails?
The address from your order. Ideally a role mailbox of the team that maintains the security.txt.
Can I change domains later?
Yes, via the link in every e-mail. If you add or remove domains, Stripe adjusts the price pro rata.
How do I cancel?
Via the management link and then the Stripe customer portal, at any time for the end of the paid year.
Does this replace our own review?
Only in part. Whether addresses, responsibilities and policy are still correct is something only your team can judge. Monitoring reliably tells you when the file is no longer technically sound and when it has to be renewed.