Security.txt extension for Plesk

The challenge

When a security researcher finds a vulnerability in a website, it should be clear where to report it. The international standard for that is security.txt (RFC 9116): a small text file in a fixed location that explains how and where to make a report. For server administrators with dozens or hundreds of domains on a Plesk server, setting that up by hand was simply not realistic. Yet those are exactly the environments that benefit from broad adoption.

Our solution

We developed a Plesk extension that generates a valid security.txt file for all hosted domains in one go. The administrator fills in the basic information once, such as contact address, encryption key and language, and the extension automatically publishes the file at the right location of every domain. Exceptions can be customized per domain through a built-in editor.

Simplicity that invites use

The interface is deliberately simple. No separate templates, no external tools, no digging through documentation. The built-in generator turns reporting details directly into a correctly formatted file, and one click puts it live. That lowers the threshold for setting it up, even for administrators who are not security experts.

The impact

Domains running on Plesk servers with this extension actively contribute to a safer web. Researchers know where to turn, administrators have nothing to maintain manually, and the end customers of hosting companies get a professional security standard for free. The extension is available in the Plesk Marketplace.

Why this project stands out

The strength is in the combination of:

• Full compliance with the international security.txt standard (RFC 9116)

• One-click generation for all domains at once

• Per-domain customization through a simple editor

• Available in the official Plesk Marketplace