CRA self-declaration

Document your security contact and support period in two minutes. Your input produces three ready-to-copy texts: a security.txt, a readme section for wordpress.org and public security information for your website. Everything runs in your browser, nothing is transmitted and nothing is stored.

This tool creates text templates from your own input. It is a first orientation, not a conformity assessment. It does not check whether the Cyber Resilience Act applies to your product, and it does not assess whether your information or your product meets the legal requirements. The generated texts are not legal advice and do not replace a review by a lawyer, in particular not on the question of whether and to what extent the Cyber Resilience Act applies to you and which support period is appropriate for your product. You are responsible for the accuracy of the texts you publish. All information without warranty, as of August 2026.

Product name

As the product is named in the directory or shop.

Version

Leave empty if the information applies to the whole product.

Vendor

Company or personal name as in your legal notice.

Product or company URL

Used for the canonical line of the security.txt.

Security contact

A dedicated mailbox such as security@ works better than the support forum. The address is only inserted into the generated texts, it is not sent anywhere.

Security policy URL

For example a page on coordinated vulnerability disclosure. Without an entry the policy line is omitted.

PGP key URL

Without an entry the encryption line is omitted.

End of support

Art. 13(8) CRA names at least five years, or the shorter expected product lifetime.

Please note: this date is a public commitment, not a statement of intent. Anyone who does not deliver security updates until then has committed to it all the same. When in doubt, set a shorter date and extend it later.

Note: Art. 13(8) provides for at least five years as a rule, shorter only where the expected product lifetime is shorter. Whether that is permissible for your product is a question for your lawyer.

Language of the public information

security.txt and the readme section are always English, that is the convention.

1. security.txt

Place at /.well-known/security.txt

Template from your own input, not legal advice. Review before publishing, consult a lawyer if in doubt.

2. readme section for wordpress.org

Into the plugin readme.txt, as its own section

Template from your own input, not legal advice. Review before publishing, consult a lawyer if in doubt.

3. Public security information

For a page such as /security or the product area

Template from your own input, not legal advice. Review before publishing, consult a lawyer if in doubt.

Cyber Resilience Act dates (Regulation (EU) 2024/2847), as of August 2026: the reporting obligations under Art. 14 apply from 11.09.2026, the full manufacturer obligations from 11.12.2027. For a bill of materials of your dependencies (SBOM), cyclonedx/cyclonedx-php-composer is the usual route, this tool does not generate an SBOM.

The finished security.txt then belongs on the server, under /.well-known/. For forcing HTTPS and setting security headers on the same server there is the .htaccess generator here, also free and without an account. To see what such a security page looks like when it is finished, have a look at our own security page, which doubles as our policy for coordinated vulnerability disclosure. The verified deadlines and four first steps, from the component list to the reporting route, are on our page Cyber Resilience Act: deadlines and what to do now (in German).

← All free tools