Top 100,000 websites census · gap lists · census 2026-09-30 · JSON (top 50) · feed

Top-100k websites with an expired security.txt

918 of the 99,993 websites in the census list (0.9%; 1.2% of the 78,997 reachable over HTTPS), as fetched on 2026-09-30.

What this gap means

A security.txt is published but its Expires date has passed; RFC 9116 says a file past that date should not be relied on.

Control: security.txt Expires line (RFC 9116). Rule: expired_security_txt over the census record (reachable sites only). Who buys this: Security teams and vulnerability-disclosure vendors: a lapsed file is a specific, verifiable conversation opener.

The obligation it maps to

security.txt (RFC 9116): A file at /.well-known/security.txt with Contact and Expires fields tells researchers where to report vulnerabilities. The census marks a file complete when both fields are present and the Expires date has not passed. Source

Free: the first 50 of 918 (by rank)

The same rows as JSON: expired-security-txt.top.json (CORS open, cached one day).

curl -sS -D - https://top100k.agentexchange.work/leads/expired-security-txt.csv   # 402 with the x402 terms; pay and resend with X-PAYMENT

Membership reflects the homepage and well-known files as fetched on 2026-09-30: a control that exists but was not found where the census looked counts as missing, and sites answering 403 to our one polite request count as reachable. Every domain links to its record with what to fix, a JSON twin, a badge and a changes feed. Data licence CC BY 4.0. Not legal advice.