{"id":397797,"date":"2026-11-11T03:05:21","date_gmt":"2026-11-11T03:05:21","guid":{"rendered":"https:\/\/wordpress.org\/plugins\/security-txt-generator\/"},"modified":"2026-11-11T03:05:00","modified_gmt":"2026-11-11T03:05:00","slug":"vulnline","status":"publish","type":"plugin","link":"https:\/\/wordpress.org\/plugins\/vulnline\/","author":23352743,"comment_status":"closed","ping_status":"closed","template":"","meta":{"version":"1.1.3","stable_tag":"1.1.3","tested":"7.1.4","requires":"5.5","requires_php":"7.4","requires_plugins":null,"header_name":"VulnLine","header_author":"Md Jahid Bin Sabit","header_description":"Generate and serve a valid RFC 9116 security.txt file at \/.well-known\/security.txt \u2014 publish your security contact info the standard way.","last_updated":"2026-11-11 03:05:00","external_support_url":"","external_repository_url":"","donate_link":"https:\/\/jbsabit.com\/","header_plugin_uri":"https:\/\/wordpress.org\/plugins\/vulnline\/","header_author_uri":"https:\/\/jbsabit.com\/","rating":0,"author_block_rating":0,"active_installs":0,"downloads":55,"num_ratings":0,"support_threads":0,"support_threads_resolved":0,"author_block_count":0,"sections":["description","installation","faq","changelog"],"tags":{"1.1.3":{"tag":"1.1.3","author":"jbsabit","date":"2026-11-11 03:05:00","revision":3795578}},"upgrade_notice":{"1.1.3":"<ul>\n<li>Renamed to VulnLine. Your settings migrate automatically; your published security.txt does not change.<\/li>\n<\/ul>"},"ratings":[],"assets_icons":{"icon-128x128.png":{"filename":"icon-128x128.png","revision":3795575,"resolution":"128x128","location":"assets","locale":"","width":128,"height":128},"icon-256x256.png":{"filename":"icon-256x256.png","revision":3795575,"resolution":"256x256","location":"assets","locale":"","width":256,"height":256}},"assets_banners":{"banner-1544x500.png":{"filename":"banner-1544x500.png","revision":3795575,"resolution":"1544x500","location":"assets","locale":"","width":1544,"height":500},"banner-772x250.png":{"filename":"banner-772x250.png","revision":3795575,"resolution":"772x250","location":"assets","locale":"","width":772,"height":250}},"assets_blueprints":{},"all_blocks":[],"tagged_versions":["1.1.3"],"block_files":[],"assets_screenshots":{"screenshot-1.png":{"filename":"screenshot-1.png","revision":3795575,"resolution":"1","location":"assets","locale":"","width":771,"height":2214},"screenshot-2.png":{"filename":"screenshot-2.png","revision":3795575,"resolution":"2","location":"assets","locale":"","width":558,"height":165},"screenshot-3.png":{"filename":"screenshot-3.png","revision":3795575,"resolution":"3","location":"assets","locale":"","width":734,"height":335},"screenshot-4.png":{"filename":"screenshot-4.png","revision":3795575,"resolution":"4","location":"assets","locale":"","width":718,"height":304},"screenshot-5.png":{"filename":"screenshot-5.png","revision":3795575,"resolution":"5","location":"assets","locale":"","width":741,"height":66}},"screenshots":{"1":"The VulnLine settings screen \u2014 live status, expiry countdown, and a live preview of your security.txt exactly as researchers will see it.","2":"Your security.txt served at \/.well-known\/security.txt with the correct plain-text format.","3":"The live preview card with syntax highlighting and one-click copy \u2014 what you save is exactly what researchers get.","4":"Built-in validation warns you the moment something is wrong \u2014 here, an Expires date in the past.","5":"A dashboard reminder appears across wp-admin if your security.txt is missing or invalid, so it never silently rots."}},"plugin_section":[],"plugin_tags":[291970,291971,149750,291969,270121],"plugin_category":[],"plugin_contributors":[287178],"plugin_business_model":[],"class_list":["post-397797","plugin","type-plugin","status-publish","hentry","plugin_tags-rfc-9116","plugin_tags-security-contact","plugin_tags-security-txt","plugin_tags-security-txt-generator","plugin_tags-vulnerability-disclosure","plugin_contributors-jbsabit","plugin_committers-jbsabit"],"banners":{"banner":"https:\/\/ps.w.org\/vulnline\/assets\/banner-772x250.png?rev=3795575","banner_2x":"https:\/\/ps.w.org\/vulnline\/assets\/banner-1544x500.png?rev=3795575","banner_rtl":false,"banner_2x_rtl":false},"icons":{"svg":false,"icon":"https:\/\/ps.w.org\/vulnline\/assets\/icon-128x128.png?rev=3795575","icon_2x":"https:\/\/ps.w.org\/vulnline\/assets\/icon-256x256.png?rev=3795575","generated":false},"screenshots":[{"src":"https:\/\/ps.w.org\/vulnline\/assets\/screenshot-1.png?rev=3795575","caption":"The VulnLine settings screen \u2014 live status, expiry countdown, and a live preview of your security.txt exactly as researchers will see it."},{"src":"https:\/\/ps.w.org\/vulnline\/assets\/screenshot-2.png?rev=3795575","caption":"Your security.txt served at \/.well-known\/security.txt with the correct plain-text format."},{"src":"https:\/\/ps.w.org\/vulnline\/assets\/screenshot-3.png?rev=3795575","caption":"The live preview card with syntax highlighting and one-click copy \u2014 what you save is exactly what researchers get."},{"src":"https:\/\/ps.w.org\/vulnline\/assets\/screenshot-4.png?rev=3795575","caption":"Built-in validation warns you the moment something is wrong \u2014 here, an Expires date in the past."},{"src":"https:\/\/ps.w.org\/vulnline\/assets\/screenshot-5.png?rev=3795575","caption":"A dashboard reminder appears across wp-admin if your security.txt is missing or invalid, so it never silently rots."}],"raw_content":"<!--section=description-->\n<p><strong>When a security researcher finds a vulnerability in your site, how do they reach you?<\/strong><\/p>\n\n<p>Most WordPress sites have no answer \u2014 so reports go to Twitter, get ignored, or never happen. <strong>VulnLine is a security.txt generator for WordPress<\/strong>: it creates and serves a valid <code>security.txt<\/code> file (RFC 9116, the internet standard for publishing security contact information) at <code>\/.well-known\/security.txt<\/code>, exactly where security researchers and bug bounty hunters look first.<\/p>\n\n<p><strong>In short:<\/strong> install VulnLine, and your WordPress site publishes a standard security contact file at <code>https:\/\/yoursite.com\/.well-known\/security.txt<\/code> \u2014 with your contact details, an expiry date, and your vulnerability disclosure policy \u2014 valid the moment you activate it, with zero configuration.<\/p>\n\n<p><strong>What is a security.txt file?<\/strong><\/p>\n\n<p>A security.txt file is a small plain-text file that tells anyone who finds a security problem on your website how to report it to you responsibly. It is defined by the IETF in RFC 9116 (published 2022) and lives at one fixed address: <code>\/.well-known\/security.txt<\/code>, served over HTTPS as <code>text\/plain<\/code>. Think of it as robots.txt for security researchers: a machine-readable signpost that says \"found a vulnerability? Here is how to tell us.\"<\/p>\n\n<p><strong>What you get<\/strong><\/p>\n\n<ul>\n<li>A valid <code>security.txt<\/code> served automatically at <code>\/.well-known\/security.txt<\/code> with the correct <code>text\/plain<\/code> content type \u2014 no file editing, no FTP, no server config<\/li>\n<li><strong>Zero-config start<\/strong> \u2014 on activation VulnLine fills in ready-to-use defaults (your site admin email as the Contact, an Expires date one year ahead, your site language), so your file is valid and live immediately<\/li>\n<li><strong>Contact<\/strong> (required) \u2014 one or more contact URIs: <code>mailto:<\/code>, <code>https:\/\/<\/code>, <code>tel:<\/code><\/li>\n<li><strong>Expires<\/strong> (required) \u2014 always a future date, with a dashboard warning before your file lapses<\/li>\n<li>Every optional RFC 9116 field: <strong>Encryption<\/strong> (PGP key link), <strong>Acknowledgments<\/strong>, <strong>Preferred-Languages<\/strong>, <strong>Policy<\/strong> (your vulnerability disclosure policy page), <strong>Hiring<\/strong>, <strong>Canonical<\/strong><\/li>\n<li><strong>Live preview<\/strong> \u2014 a syntax-highlighted preview with one-click copy; see exactly what researchers will see before you save<\/li>\n<li><strong>Built-in RFC 9116 validation<\/strong> \u2014 catches bad contact URIs, past Expires dates and malformed fields, with clear error messages<\/li>\n<li><strong>Admin reminder<\/strong> \u2014 a dashboard notice if your security.txt is missing or invalid, so it never silently rots<\/li>\n<\/ul>\n\n<p><strong>What a valid security.txt looks like<\/strong><\/p>\n\n<p>Contact: mailto:security@example.com\nExpires: 2027-11-10T23:59:59Z\nPreferred-Languages: en\nPolicy: https:\/\/example.com\/security-policy\nCanonical: https:\/\/example.com\/.well-known\/security.txt<\/p>\n\n<p>Only <code>Contact<\/code> and <code>Expires<\/code> are required by RFC 9116. VulnLine generates this file for you, keeps the format correct, and updates it the moment you save your settings.<\/p>\n\n<p><strong>Why your WordPress site needs a security.txt<\/strong><\/p>\n\n<ul>\n<li>Google, Facebook, the US CISA and thousands of bug-bounty programs publish a security.txt \u2014 it is the expected standard for responsible disclosure<\/li>\n<li>Security researchers, ethical hackers and vulnerability scanners (including internet.nl-style compliance checks) look for <code>\/.well-known\/security.txt<\/code> first; without one, many simply move on \u2014 or disclose publicly<\/li>\n<li>The EU Cyber Resilience Act pushes vendors toward coordinated vulnerability disclosure; a security.txt is the simplest way to publish yours<\/li>\n<li>A reachable security contact turns a potential public incident into a quiet, responsible report<\/li>\n<\/ul>\n\n<p><strong>Why a plugin instead of uploading the file by hand?<\/strong><\/p>\n\n<p>You can create a <code>.well-known<\/code> folder and upload a text file by FTP \u2014 if you have filesystem access and get every detail right. In practice, hand-made files break silently: the folder is lost in a site migration, the file is served as <code>text\/html<\/code> instead of <code>text\/plain<\/code>, the Expires date passes unnoticed, or the file is edited into an invalid format. VulnLine serves security.txt dynamically through WordPress, validates it against RFC 9116 every time you save, and warns you in the dashboard if anything is wrong \u2014 including an Expires date that is about to lapse.<\/p>\n\n<p><strong>Privacy<\/strong><\/p>\n\n<p>This plugin collects nothing, phones home nowhere, and adds zero front-end weight \u2014 it only serves one tiny text file when requested.<\/p>\n\n<p>Built by WordPress security specialist Md Jahid Bin Sabit \u2014 <a href=\"https:\/\/jbsabit.com\/\">jbsabit.com<\/a><\/p>\n\n<!--section=installation-->\n<ol>\n<li>Upload the plugin files to <code>\/wp-content\/plugins\/vulnline\/<\/code>, or install through the WordPress plugins screen.<\/li>\n<li>Activate the plugin \u2014 your security.txt is already valid and live with sensible defaults.<\/li>\n<li>Go to <strong>Settings \u2192 VulnLine<\/strong> to review or change your contact info.<\/li>\n<li>Visit <code>yoursite.com\/.well-known\/security.txt<\/code> to see it live.<\/li>\n<\/ol>\n\n<!--section=faq-->\n<dl>\n<dt id=\"what%20is%20a%20security.txt%20file%3F\"><h3>What is a security.txt file?<\/h3><\/dt>\n<dd><p>A security.txt file is a plain-text file, defined by RFC 9116, that tells security researchers how to report a vulnerability in your website. It is published at <code>\/.well-known\/security.txt<\/code> and must contain at least a <code>Contact<\/code> field (where to send reports) and an <code>Expires<\/code> field (when the information goes stale).<\/p><\/dd>\n<dt id=\"where%20does%20security.txt%20go%20on%20a%20wordpress%20site%3F\"><h3>Where does security.txt go on a WordPress site?<\/h3><\/dt>\n<dd><p>At <code>https:\/\/yoursite.com\/.well-known\/security.txt<\/code> \u2014 that is the only location RFC 9116 requires, served over HTTPS with the content type <code>text\/plain<\/code>. VulnLine serves it at exactly that address automatically; you do not create folders or upload files.<\/p><\/dd>\n<dt id=\"does%20wordpress%20create%20a%20security.txt%20file%20automatically%3F\"><h3>Does WordPress create a security.txt file automatically?<\/h3><\/dt>\n<dd><p>No. WordPress core does not generate a security.txt file, and most hosts do not add one either. Without a plugin or a manually uploaded file, <code>\/.well-known\/security.txt<\/code> on a WordPress site returns a 404 \u2014 which is the gap VulnLine fills.<\/p><\/dd>\n<dt id=\"how%20do%20i%20add%20security.txt%20to%20wordpress%20without%20ftp%20or%20server%20access%3F\"><h3>How do I add security.txt to WordPress without FTP or server access?<\/h3><\/dt>\n<dd><p>Install VulnLine and activate it. WordPress cannot write a real file to <code>\/.well-known\/<\/code> by itself, so the plugin serves security.txt dynamically at that exact URL with the correct <code>text\/plain<\/code> content type \u2014 no FTP, cPanel, file manager or <code>.htaccess<\/code> edits needed.<\/p><\/dd>\n<dt id=\"what%20should%20a%20security.txt%20file%20contain%3F\"><h3>What should a security.txt file contain?<\/h3><\/dt>\n<dd><p>Two fields are required by RFC 9116: <code>Contact<\/code> (a <code>mailto:<\/code>, <code>https:\/\/<\/code> or <code>tel:<\/code> URI that a human actually reads) and <code>Expires<\/code> (a future date, ideally less than a year ahead). Optional fields are <code>Encryption<\/code> (your PGP key), <code>Policy<\/code> (your disclosure policy page), <code>Preferred-Languages<\/code>, <code>Acknowledgments<\/code>, <code>Hiring<\/code> and <code>Canonical<\/code>. VulnLine's settings screen covers all of them.<\/p><\/dd>\n<dt id=\"is%20security.txt%20required%20by%20law%3F\"><h3>Is security.txt required by law?<\/h3><\/dt>\n<dd><p>No \u2014 RFC 9116 is a voluntary standard, not a law. That said, it is mandatory for Dutch government organisations, recommended by security agencies such as the UK NCSC, and the direction of regulation (for example the EU Cyber Resilience Act's coordinated-disclosure requirements) is toward every product and site having a published security contact. Having one costs nothing and takes a minute.<\/p><\/dd>\n<dt id=\"what%20is%20the%20difference%20between%20security.txt%20and%20robots.txt%3F\"><h3>What is the difference between security.txt and robots.txt?<\/h3><\/dt>\n<dd><p>Different audiences. <code>robots.txt<\/code> tells search-engine crawlers which pages they may index. <code>security.txt<\/code> tells security researchers how to contact you about vulnerabilities. They live in different places, too: robots.txt sits in the root, security.txt belongs at <code>\/.well-known\/security.txt<\/code>.<\/p><\/dd>\n<dt id=\"do%20i%20need%20to%20configure%20anything%3F\"><h3>Do I need to configure anything?<\/h3><\/dt>\n<dd><p>No. On activation VulnLine fills in ready-to-use defaults \u2014 your site admin email as the Contact, an Expires date one year ahead, and your site language \u2014 so the file is valid and live immediately. Change anything you like under Settings \u2192 VulnLine.<\/p><\/dd>\n<dt id=\"can%20i%20add%20security.txt%20without%20a%20plugin%3F\"><h3>Can I add security.txt without a plugin?<\/h3><\/dt>\n<dd><p>Yes, if you have FTP or file-manager access: create a <code>.well-known<\/code> folder in your web root and upload a correctly formatted <code>security.txt<\/code> file. The plugin route is safer for most sites \u2014 it guarantees the <code>text\/plain<\/code> content type, validates the format, survives migrations and theme changes, and reminds you before the Expires date lapses.<\/p><\/dd>\n<dt id=\"do%20i%20need%20this%20if%20i%20already%20have%20a%20contact%20page%20or%20a%20disclosure%20policy%3F\"><h3>Do I need this if I already have a contact page or a disclosure policy?<\/h3><\/dt>\n<dd><p>Yes. Researchers check <code>\/.well-known\/security.txt<\/code> first \u2014 it is machine-readable and unambiguous, unlike a contact form buried three clicks deep. VulnLine also links your existing policy page in the <code>Policy<\/code> field, so the two work together.<\/p><\/dd>\n<dt id=\"how%20do%20i%20know%20my%20security.txt%20is%20valid%3F\"><h3>How do I know my security.txt is valid?<\/h3><\/dt>\n<dd><p>Open <code>yoursite.com\/.well-known\/security.txt<\/code> \u2014 you should see plain text, not a 404 or a web page. VulnLine goes further: it validates every save against RFC 9116, shows a live status (valid \/ action needed) on its settings screen, and warns you in the dashboard if the file ever becomes invalid.<\/p><\/dd>\n<dt id=\"what%20happens%20when%20the%20expires%20date%20passes%3F\"><h3>What happens when the Expires date passes?<\/h3><\/dt>\n<dd><p>Researchers treat the file as stale and may not trust or use the contact details. VulnLine shows a countdown on its settings screen and warns you in the dashboard if your file is missing or invalid \u2014 set a calendar reminder to renew the date yearly.<\/p><\/dd>\n<dt id=\"why%20is%20it%20called%20vulnline%3F\"><h3>Why is it called VulnLine?<\/h3><\/dt>\n<dd><p>Because that is what it is: a direct line for vulnerability reports. When a researcher finds a bug, VulnLine makes sure they can reach you \u2014 through the standard security.txt file (RFC 9116) at \/.well-known\/security.txt.<\/p><\/dd>\n<dt id=\"will%20this%20work%20with%20caching%20plugins%20%2F%20cloudflare%3F\"><h3>Will this work with caching plugins \/ Cloudflare?<\/h3><\/dt>\n<dd><p>The file is served dynamically through WordPress. If you use aggressive full-page caching, exclude the <code>\/.well-known\/security.txt<\/code> path so updates appear immediately.<\/p><\/dd>\n<dt id=\"does%20it%20slow%20down%20my%20site%3F\"><h3>Does it slow down my site?<\/h3><\/dt>\n<dd><p>No. Nothing loads on the front end; the plugin only responds when <code>\/.well-known\/security.txt<\/code> itself is requested.<\/p><\/dd>\n\n<\/dl>\n\n<!--section=changelog-->\n<h4>1.1.3<\/h4>\n\n<ul>\n<li>Renamed to VulnLine (new slug) with a full internal re-prefix: every function, class, constant, option and handle now uses the unique vulnline_ prefix. Settings saved under either previous name (Bugline, Security.txt Generator) migrate automatically \u2014 your published security.txt does not change.<\/li>\n<\/ul>\n\n<h4>1.1.2<\/h4>\n\n<ul>\n<li>Easy setup: the plugin now configures itself on first run \u2014 Contact is filled with the site admin email, Expires is set one year ahead, and Preferred-Languages follows the site language, so the file is valid and live the moment you activate. Sites upgrading with an empty Contact get it filled once, automatically.<\/li>\n<\/ul>\n\n<h4>1.1.1<\/h4>\n\n<ul>\n<li>Fix: sanitize the request URI used by the plain-permalink fallback (Plugin Check warning). No behaviour change.<\/li>\n<\/ul>\n\n<h4>1.1.0<\/h4>\n\n<ul>\n<li>Renamed to Bugline (new slug) with a full internal re-prefix: every function, class, constant, option and handle now uses the unique bugline_ prefix. Existing settings migrate automatically \u2014 your published security.txt does not change.<\/li>\n<\/ul>\n\n<h4>1.0.4<\/h4>\n\n<ul>\n<li>Hardening and robustness: ABSPATH guards on all class files, plain-permalink fallback for serving the file, trailing-slash tolerance, dead-code cleanup. No behavior change.<\/li>\n<\/ul>\n\n<h4>1.0.3<\/h4>\n\n<ul>\n<li>Premium settings UI: branded top bar, gradient status hero with stat tiles, icon-headed cards, terminal-style syntax-highlighted preview, and polished form styling.<\/li>\n<\/ul>\n\n<h4>1.0.2<\/h4>\n\n<ul>\n<li>Improved settings UI: status hero card (live\/valid state with expiry countdown), grouped Required\/Optional field cards, and a copy button on the live preview.<\/li>\n<\/ul>\n\n<h4>1.0.1<\/h4>\n\n<ul>\n<li>Code quality: inline escaping on all admin outputs (resolves Plugin Check EscapeOutput notices) and Tested up to 7.1. No behavior change.<\/li>\n<\/ul>\n\n<h4>1.0.0<\/h4>\n\n<ul>\n<li>Initial release: RFC 9116 security.txt generation, validation, live preview, and automatic serving at \/.well-known\/security.txt.<\/li>\n<\/ul>","raw_excerpt":"Security.txt generator for WordPress: add a valid RFC 9116 security.txt at \/.well-known\/security.txt so researchers can report bugs to you.","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin\/397797","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin"}],"about":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/types\/plugin"}],"replies":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/comments?post=397797"}],"author":[{"embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wporg\/v1\/users\/jbsabit"}],"wp:attachment":[{"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/media?parent=397797"}],"wp:term":[{"taxonomy":"plugin_section","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_section?post=397797"},{"taxonomy":"plugin_tags","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_tags?post=397797"},{"taxonomy":"plugin_category","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_category?post=397797"},{"taxonomy":"plugin_contributors","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_contributors?post=397797"},{"taxonomy":"plugin_business_model","embeddable":true,"href":"https:\/\/wordpress.org\/plugins\/wp-json\/wp\/v2\/plugin_business_model?post=397797"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}