security.txt missing required Expires field (RFC 9116)

This check looks at the site's /.well-known/security.txt file for a required 'Expires:' field, a future date that tells anyone reading the file how long the contact information in it should be considered current. On this site, security.txt is missing this field. Without an Expires date, there's no built-in freshness guarantee on the security contact information in the file, meaning it could be years out of date with no way for a reader to know that. Some browsers and compliance scanners will also flag a security.txt file without this field as technically invalid under RFC 9116, the standard defining the format. Your developer should add a line such as 'Expires: 2027-01-01T00:00:00Z', using any reasonable future date in ISO 8601 format, to the existing security.txt file, then redeploy so the updated file is actually served. Roughly a 30-second fix once someone has access to edit the file directly.