World government web census · gap lists · census 2026-09-30 · JSON (top 50) · feed
Government domains with an expired security.txt
296 of the 62,016 government domains in the census list (0.5%; 0.6% of the 47,738 reachable over HTTPS), as fetched on 2026-09-30.
On this list
296
of 62,016 government domains
Share of the list
0.5%
0.6% of reachable sites
Countries
10
largest: the Netherlands (123)
Full list
1.00 USDC
x402, per file; first 50 rows free
What this gap means
A security.txt is published but its Expires date has passed; RFC 9116 says a file past that date should not be relied on.
Control: security.txt Expires line (RFC 9116). Rule: expired_security_txt over the census record (reachable sites only). Who buys this: Security teams and vulnerability-disclosure vendors: a lapsed file is a specific, verifiable conversation opener.
The obligation it maps to
Vulnerability disclosure: security.txt (RFC 9116): RFC 9116 defines /.well-known/security.txt so researchers can find a contact and a policy; several national cyber agencies (NCSC UK, NCSC-NL, ANSSI, ACSC) recommend or require it for government sites. Source
By country
10 countries with at least one government domain on this list; "of the country" is the share of its government domains in the census list. One country as CSV: 0.25 USDC (x402).
| Country | On this list | Of the country | CSV (x402) |
|---|---|---|---|
| the Netherlands (report) | 123 | 8.7% | https://world.agentexchange.work/leads/expired-security-txt/state/NL.csv · card $9 |
| France (report) | 79 | 0.3% | https://world.agentexchange.work/leads/expired-security-txt/state/FR.csv · card $9 |
| the United Kingdom (report) | 56 | 0.7% | https://world.agentexchange.work/leads/expired-security-txt/state/GB.csv · card $9 |
| Australia (report) | 15 | 3.3% | https://world.agentexchange.work/leads/expired-security-txt/state/AU.csv · card $9 |
| Italy (report) | 12 | 0.1% | https://world.agentexchange.work/leads/expired-security-txt/state/IT.csv · card $9 |
| Germany (report) | 4 | 1.6% | https://world.agentexchange.work/leads/expired-security-txt/state/DE.csv · card $9 |
| New Zealand (report) | 3 | 0.9% | https://world.agentexchange.work/leads/expired-security-txt/state/NZ.csv · card $9 |
| Canada (report) | 2 | 1.6% | https://world.agentexchange.work/leads/expired-security-txt/state/CA.csv · card $9 |
| Brazil (report) | 1 | 0.7% | https://world.agentexchange.work/leads/expired-security-txt/state/BR.csv · card $9 |
| the European Union (report) | 1 | 1.9% | https://world.agentexchange.work/leads/expired-security-txt/state/EU.csv · card $9 |
Free: the first 50 of 296 (alphabetical)
| Domain | Body type (country and source category) | Country | Source register | Census record |
|---|---|---|---|---|
| aalten.nl Gemeente Aalten | Netherlands (Gemeente) | NL | ROO exportOO.xml | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot allowed |
| abc.net.au Australian Broadcasting Corporation | Australia federal (B. Corporate Commonwealth entity) | AU | AGOR 2026-06-30 | HTTP 200 · HSTS no · security.txt expired · privacy no · accessibility no · GPTBot blocked |
| abcb.gov.au Australian Building Codes Board | Australia federal (J. Inter-jurisdictional and international | AU | AGOR 2026-06-30 | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility yes · GPTBot blocked |
| about.abc.net.au ABC Advisory Council | Australia federal (E. Statutory office holder, offices and c | AU | AGOR 2026-06-30 | HTTP 200 via www.abc.net.au · HSTS no · security.txt expired · privacy yes · accessibility yes · GPTBot blocked |
| abs.gov.au Australian Bureau of Statistics | Australia federal (A. Non-corporate Commonwealth entity) | AU | AGOR 2026-06-30 | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked |
| acquedottosca.it SERVIZI COMUNALI ASSOCIATI SRL | Italy (Gestori di Pubblici Servizi) | IT | IndicePA enti | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility no · GPTBot partly blocked |
| aga.gov.au Australian Government Actuary | Australia federal (G. Non-statutory function with separate b | AU | AGOR 2026-06-30 | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility no · GPTBot partly blocked |
| agid.gov.it Agenzia per L'Italia Digitale | Italy (Pubbliche Amministrazioni) | IT | IndicePA enti | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked |
| aiglepierre.fr Mairie - Aiglepierre | France (type not stated in annuaire) | FR | Service-Public annuaire | HTTP 200 via collectivite.fr · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot allowed |
| aldhamparishcouncil.gov.uk | UK gov.uk (all registrants) | GB | GOV.UK .gov.uk list 2026-03-31 | HTTP 200 · HSTS no · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked |
| almelo.nl Gemeente Almelo | Netherlands (Gemeente) | NL | ROO exportOO.xml | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility no · GPTBot partly blocked |
| almere.nl Gemeente Almere | Netherlands (Gemeente) | NL | ROO exportOO.xml | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility no · GPTBot partly blocked |
| amstelveen.nl Gemeente Amstelveen | Netherlands (Gemeente) | NL | ROO exportOO.xml | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility no · GPTBot partly blocked |
| annoire.fr Mairie - Annoire | France (type not stated in annuaire) | FR | Service-Public annuaire | HTTP 200 via collectivite.fr · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot allowed |
| archives.cotesdarmor.fr Archives départementales - Côtes-d'Armor | France (Collectivité locale) | FR | Service-Public annuaire | HTTP 200 · HSTS no · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| arun.gov.uk | UK gov.uk (all registrants) | GB | GOV.UK .gov.uk list 2026-03-31 | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked |
| asac.gov.au Australian Statistics Advisory Council | Australia federal (E. Statutory office holder, offices and c | AU | AGOR 2026-06-30 | HTTP 200 via www.abs.gov.au · HSTS yes · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked |
| ashdonparishcouncil.gov.uk | UK gov.uk (all registrants) | GB | GOV.UK .gov.uk list 2026-03-31 | HTTP 200 · HSTS no · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked |
| audelange.fr Mairie - Audelange | France (type not stated in annuaire) | FR | Service-Public annuaire | HTTP 200 via collectivite.fr · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot allowed |
| aumont39.fr Mairie - Aumont | France (type not stated in annuaire) | FR | Service-Public annuaire | HTTP 200 via collectivite.fr · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot allowed |
| baanstede.nl Werkvoorzieningschap Zaanstreek-Waterland | Netherlands (Regionaal samenwerkingsorgaan) | NL | ROO exportOO.xml | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no |
| balaiseaux.fr Mairie - Balaiseaux | France (type not stated in annuaire) | FR | Service-Public annuaire | HTTP 200 via collectivite.fr · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot allowed |
| barneveld.nl Gemeente Barneveld | Netherlands (Gemeente) | NL | ROO exportOO.xml | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked |
| barnim.de Landrätin|Landrat Landkreis Barnim | Germany Brandenburg (Allgemeine untere Landesbehörden) | DE | Brandenburg Behördenverzeichnis | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot partly blocked |
| bergendal.nl Gemeente Berg en Dal | Netherlands (Gemeente) | NL | ROO exportOO.xml | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot allowed |
| bergenopzoom.nl Gemeente Bergen op Zoom | Netherlands (Gemeente) | NL | ROO exportOO.xml | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility no · GPTBot allowed |
| bernheze.org Gemeente Bernheze | Netherlands (Gemeente) | NL | ROO exportOO.xml | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility no · GPTBot allowed |
| birchparishcouncil.gov.uk | UK gov.uk (all registrants) | GB | GOV.UK .gov.uk list 2026-03-31 | HTTP 200 · HSTS no · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked |
| boisdegand.fr Mairie - Bois-de-Gand | France (type not stated in annuaire) | FR | Service-Public annuaire | HTTP 200 via collectivite.fr · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot allowed |
| bourgdesirod.fr Mairie - Bourg-de-Sirod | France (type not stated in annuaire) | FR | Service-Public annuaire | HTTP 200 via collectivite.fr · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot allowed |
| bovi2050.nl Vallei en Veluwe | Netherlands (Waterschap) | NL | ROO exportOO.xml | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot allowed |
| bracon.fr Mairie - Bracon | France (type not stated in annuaire) | FR | Service-Public annuaire | HTTP 200 via collectivite.fr · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot allowed |
| brandweer.nl Brandweer-GHOR Zuid-Limburg | Netherlands (Regionaal samenwerkingsorgaan) | NL | ROO exportOO.xml | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility no · GPTBot allowed |
| branthamparishcouncil.gov.uk | UK gov.uk (all registrants) | GB | GOV.UK .gov.uk list 2026-03-31 | HTTP 200 · HSTS no · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked |
| breda.nl Gemeente Breda | Netherlands (Gemeente) | NL | ROO exportOO.xml | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility no · GPTBot partly blocked |
| burgerberichten.nl Gemeente Landsmeer | Netherlands (Gemeente) | NL | ROO exportOO.xml | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot partly blocked |
| bvowb.nl Bedrijfsvoeringsorganisatie West Betuwe | Netherlands (Regionaal samenwerkingsorgaan) | NL | ROO exportOO.xml | HTTP 403 · HSTS no · security.txt expired · privacy no · accessibility no |
| cafcass.gov.uk | UK gov.uk (all registrants) | GB | GOV.UK .gov.uk list 2026-03-31 | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility no · GPTBot partly blocked |
| calderdale.gov.uk | UK gov.uk (all registrants) | GB | GOV.UK .gov.uk list 2026-03-31 | HTTP 200 · HSTS no · security.txt expired · privacy no · accessibility no · GPTBot partly blocked |
| caparis.nl Sociale werkvoorziening Fryslân | Netherlands (Regionaal samenwerkingsorgaan) | NL | ROO exportOO.xml | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot partly blocked |
| capelleaandenijssel.nl Gemeente Capelle aan den IJssel | Netherlands (Gemeente) | NL | ROO exportOO.xml | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility no · GPTBot allowed |
| casasuarez.it Azienda Servizi alla Persona A.Suarez | Italy (Pubbliche Amministrazioni) | IT | IndicePA enti | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility no · GPTBot partly blocked |
| cbnbl.org Conservatoire botanique national de Bailleul | France (Association d'utilité publique) | FR | Service-Public annuaire | HTTP 200 via www.cbnhdf.fr · HSTS no · security.txt expired · privacy no · accessibility no · GPTBot partly blocked |
| ccrc.gov.uk | UK gov.uk (all registrants) | GB | GOV.UK .gov.uk list 2026-03-31 | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility yes |
| cdc.govt.nz Carterton District Council | New Zealand | NZ | govt.nz A-Z organisations | HTTP 403 · HSTS no · security.txt expired · privacy no · accessibility no · GPTBot partly blocked |
| cdg-41.org Centre de gestion de la fonction publique territoriale - Loir-et-Cher | France (type not stated in annuaire) | FR | Service-Public annuaire | HTTP 200 · HSTS no · security.txt expired · privacy no · accessibility no · GPTBot partly blocked |
| censeau.fr Mairie - Censeau | France (type not stated in annuaire) | FR | Service-Public annuaire | HTTP 200 via collectivite.fr · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot allowed |
| chapois.fr Mairie - Chapois | France (type not stated in annuaire) | FR | Service-Public annuaire | HTTP 200 via collectivite.fr · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot allowed |
| charchilla.fr Mairie - Charchilla | France (type not stated in annuaire) | FR | Service-Public annuaire | HTTP 200 via collectivite.fr · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot allowed |
| chatillon39.fr Mairie - Châtillon | France (type not stated in annuaire) | FR | Service-Public annuaire | HTTP 200 via collectivite.fr · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot allowed |
The same rows as JSON: expired-security-txt.top.json (CORS open, cached one day).
Get the full list: 296 rows, 1.00 USDC
x402 on Base, paid per file, no account or key. GET https://world.agentexchange.work/leads/expired-security-txt.csv or GET https://world.agentexchange.work/leads/expired-security-txt.json answers 402 Payment Required with the terms (scheme exact, USDC on Base, maxAmountRequired 1000000, payTo 0xc91cE6291eDC0713ec753BAFBA002506ffb2b95c); an x402 client signs the EIP-3009 authorization and resends the same request with X-PAYMENT; the file comes back with a PAYMENT-RESPONSE header. HEAD gets the same 402. One country: GET https://world.agentexchange.work/leads/expired-security-txt/state/<code>.csv, 0.25 USDC (codes in the table above).
curl -sS -D - https://world.agentexchange.work/leads/expired-security-txt.csv # 402 with the x402 terms; pay and resend with X-PAYMENT
Columns (19): domain, name, type, city, state, source_register, reachable, http_only, https_status, final_host, hsts, security_txt, privacy_link, accessibility_link, robots_gptbot, robots_chatgpt_user, robots_claude_user, llms_txt, title. CSV: header row, every cell quoted, yes/no for booleans. JSON: { list, title, count, by_state, columns, rows[][] }. Sizes: CSV 73 KB, JSON 75 KB. The same facts are in the free CC BY 4.0 dumps: the price buys the filtered, country-sliceable file built from the 2026-09-30 census, not exclusive data. Settlement is final; no refunds. Prices in /.well-known/x402 equal the challenges. Terms · pricing.
Card checkout
Pay with a card through Stripe and get the file on the next page: Full list CSV, $29 · JSON, $29 · one country $9 (links in the table below) · all 5 lists, $79. Agents pay less with x402 (see above).
Monitor this list (free)
Atom feed: government domains that entered or left this list according to the live re-checks (every 6 hours a rotating slice, each domain at most once per 14 days; each entry says which way it moved and which field changed). expired-security-txt.top.json: the first 50 rows and the counts by country as JSON, CORS open. Fields watched: security_txt, security_txt.expired.
Membership reflects the homepage and well-known files as fetched on 2026-09-30: a control that exists but was not found where the census looked counts as missing, and sites answering 403 to our one polite request count as reachable. Every domain links to its record with what to fix, a JSON twin, a badge and a changes feed. Data licence CC BY 4.0. Not legal advice.