manifest / security / security-txt-generator

Security.txt Generator

RFC 9116 security.txt generator for WordPress

by Md Jahid Bin Sabit · github.com/jahidbinsabit/security-txt-generator · website

★ 0stars

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/jahidbinsabit/security-txt-generator/archive/refs/heads/main.zip

No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

Readme github.com/jahidbinsabit/security-txt-generator ↗

Publish a valid RFC 9116 security.txt file at /.well-known/security.txt — tell security researchers exactly how to contact you about vulnerabilities.

Features

RFC 9116 compliant — Contact & Expires required, full validation with plain-language errors
Automatic serving — the file is served as text/plain at /.well-known/security.txt (pretty and plain permalinks, trailing-slash tolerant)
Expiry countdown — status hero shows days until expiry; dashboard nag if the file is missing or invalid
Live preview — terminal-style syntax-highlighted preview of exactly what researchers will see
Zero config to start — sensible defaults, Contact is the only thing you must add
Lightweight — no bloat, no tracking, no upsells

Installation

Upload the plugin folder to /wp-content/plugins/ or install the ZIP via Plugins → Add New → Upload.
Activate Security.txt Generator.
Go to Settings → Security.txt and add your contact details (e.g. mailto:security@example.com).
Set a calendar reminder before the Expires date — an expired security.txt tells researchers you've stopped listening.

Requirements

WordPress 5.5+
PHP 7.4+

License

GPLv2 or later — same as WordPress.

Author

Md Jahid Bin Sabit — WordPress Security Specialist (jbsabit.com)