Internet.nl adds test for security.txt

News | October 11, 2022

A new security.txt test component has been added to the Internet.nl website test in collaboration with the Digital Trust Center (DTC). security.txt is a standardised text file containing contact information that you place on your web server. Security researchers can use this information to contact the right department or person within your organization directly about vulnerabilities they have found in your website or IT systems. This can speed up the resolution of the vulnerabilities found, giving malicious parties less opportunity to exploit them. In short: test your own domain and publish a security.txt file!

What is your contact point for security vulnerabilities?

At any time, security researchers (also known as benevolent or ethical hackers) may find digital vulnerabilities in your website or IT systems. Of course, you want to be informed as fast as possible when such a discovery is made, so you can respond quickly and fix the leak. Unfortunately, it is often unclear where a security researcher can report a found vulnerability. This means valuable time may be lost in finding and reaching the right department or person within an organisation. The well-intentioned message may not even reach anyone at all.

Faster warnings with security.txt

Since malicious parties can also detect these vulnerabilities, no avoidable time should be lost in alerting affected organisations. The Digital Trust Center (DTC) regularly experiences that this speed is important when alerting Dutch companies. security.txt can help. By making contact information available through security.txt as an organisation, security researchers can immediately alert the right person or department. The DTC therefore recommends that every company publishes a security.txt file and keeps it up to date.

Internet.nl test on security.txt

The new test for security.txt in Internet.nl is intended as a tool for companies and other organisations. The test checks whether the security.txt file is present on the domain name and whether the information included has the correct format.

Gerben Klein Baltink, chair Internet Standards Platform:

"Together with the DTC, we worked to ensure that Internet.nl now also tests for security.txt. By simply adding this standardised format to your web domain, it has become easier for "helping hackers" to find the right contacts if they find a vulnerability with you. I therefore warmly encourage organisations to publish a security.txt file and check via Internet.nl whether this has been done correctly. This is how we keep the Internet open, free and secure together!"

For now, the security.txt standard within Internet.nl has the recommended status. The results of the security.txt test do not yet weigh into the overall test result score. Later this year, the security.txt test will also be added to Internet.nl's API and dashboard. The Netherlands Standardisation Forum is currently reviewing whether the security.txt standard is suitable to become mandatory for the government via inclusion on the 'comply or explain' list.

Want to know more?

Does your company or organisation already have a security.txt file? Enter your website URL at Internet.nl and you'll know within seconds. Wondering how to easily create your own security.txt file? Then read more about security.txt on the DTC website (in Dutch).

About Internet.nl

The test tool Internet.nl is an initiative of the Dutch Internet Standards Platform which is a collaboration of partners from the Internet community and the Dutch government. The aim of the platform is to jointly increase the use of modern Internet standards to make the Internet more accessible, safer and more reliable for everyone. The software code of Internet.nl is available under an open source license.

Release notes 1.6.0

Upgrading to 1.6 from 1.5.x

See the change overview in the documentation of version 1.6 for the steps to upgrade if you have your own deployment of the internet.nl codebase.

Other news

Read more articles

Frequently asked questions

How can I improve the score of a test?

In the test results, you will find an explanation of our findings for all the (sub)tests. Based on this, you could (let someone) make changes to your web or mailserver or connection.

Additional information can be found in our Knowledge base or our Toolbox Wiki.

Why do other test tools show different results?

Internet.nl attempts to always test against the most recent norms and standards. Additionally, we test as thoroughly as we can realise. This is why our results can differ from other (commonly-used) testing tools.

Some of the norms used in Internet.nl are set by the Dutch government. These can be implemented world-wide (and we recommend it!), but be aware that local regulations may differ from the norms used in Internet.nl.

How can I keep up to date of new developments?

News about Internet.nl is always shared on our website and social media. New versions are announced in a news post with the most important changes. You can also follow our work on the source code, new ideas and contributions are very welcome as well!

Users of our API and dashboard are automatically signed up to a mailing list in which we share updates and organise virtual meetings.

How can I (regularly) test multiple domain names?

This is supported by our dashboard and API. You can request an account here if your organisation fits in the target audience. The dashboard is also open source, so you could host this yourself as well.

In the dashboard, it is possible to enter lists of domain names, which then can be automatically tested on a specified interval. You can opt-in to receive an e-mail for every test result.

Can I join the Dutch Internet Standards Platform?

Where our Platform is focused on Dutch organisations, we are facilitating the Global Internet Standards Testing Community (GISTC) to connect international users of the test tool. You can register yourself for the community via international@internet.nl.

Find more answers