July 26, 2026

Monitor security.txt across a domain portfolio with Apify

Build a recurring security.txt monitoring workflow that checks public domains, detects missing or expired files, and routes structured findings to the team responsible for vendor risk or security operations.

Short answer: Use Security.txt Checker to submit a bounded list of public domains, inspect each domain's RFC 9116 file, and return a structured status for missing, found, or expired records. Run the same portfolio on a schedule and route only actionable status changes into an operations workflow.

Commercial use: Positioning the Actor as a scheduled portfolio control will convert one-off checks into weekly recurring runs from security and compliance teams, increasing sustainable paid usage.

Verified proof run

Public input shape

{
  "startUrls": [
    "<string>"
  ],
  "includeRootFallback": "<boolean>",
  "maxResults": "<number>",
  "proxyConfiguration": {
    "useApifyProxy": "<boolean>"
  }
}

Output shape

[
  {
    "domain": "<string>",
    "checkedUrl": "<string>",
    "finalUrl": "<string>",
    "status": "<string>",
    "hasSecurityTxt": "<string>"
  }
]

Why security.txt belongs in recurring controls

A security.txt file gives researchers and automated systems a defined route to an organization's vulnerability-reporting information. Because the file can disappear, expire, or move after a website release, a one-time inventory does not provide durable assurance for a vendor portfolio.

Source

What the Actor checks

For each supplied domain, the Actor requests the standard well-known path and can optionally try the older root path. It records whether a file was found, whether its expiry is in the past, and which structured field groups are present, while returning missing files as useful audit results rather than hiding them.

Source Source

Design a bounded portfolio run

Start with a small set of public vendor or customer-facing domains and set an explicit maximum result count. Keep the same normalized domain list between runs so that downstream systems can compare status and expiry fields without treating harmless input reordering as a new finding.

Source

Turn checks into an n8n operations loop

An n8n workflow fits this operational use case because it can prepare a domain portfolio, start the Actor, poll the same run to completion, retrieve the dataset, compare statuses with the previous cycle, and send only new missing or expired findings to the chosen destination.

Schedule the workflow weekly for ordinary vendor monitoring or more frequently for high-change portfolios. Apify also supports cron-based Actor schedules, but use one scheduling owner per workflow so a single monitoring cycle cannot be launched twice.

Source Source

Interpret results without overclaiming

A found file confirms that a public security.txt resource was retrieved and parsed; it does not prove that reports will receive a response or that the organization has a complete vulnerability-management program. Missing and expired statuses are operational signals for follow-up, not standalone evidence of non-compliance.

Source Source

Reusable automation

Open the tested n8n example.

Run one public domain as a bounded check, verify the structured status, then connect a stable domain portfolio to the n8n monitoring workflow for recurring review.

Run the Actor on Apify.