Government web census · gap lists · census 2026-09-30 · JSON (top 50) · feed
.gov domains with an expired security.txt
63 of the 16,783 .gov domains in the census list (0.4%; 0.5% of the 13,060 reachable over HTTPS), as fetched on 2026-09-30.
On this list
63
of 16,783 .gov domains
Share of the list
0.4%
0.5% of reachable sites
States
14
largest: Iowa (27)
Full list
1.00 USDC
x402, per file; first 50 rows free
What this gap means
A security.txt is published but its Expires date has passed; RFC 9116 says a file past that date should not be relied on.
Control: security.txt Expires line (RFC 9116). Rule: expired_security_txt over the census record (reachable sites only). Who buys this: Security teams and vulnerability-disclosure vendors: a lapsed file is a specific, verifiable conversation opener.
The obligation it maps to
RFC 9116 security.txt: The security.txt standard (April 2022) defines the /.well-known/security.txt location and requires Contact and Expires fields. The census marks a file complete when both are present and the Expires date has not passed. Source
By state
14 states with at least one .gov domain on this list; "of the state" is the share of its .gov domains in the census list. One state as CSV: 0.25 USDC (x402).
| State | On this list | Of the state | CSV (x402) |
|---|---|---|---|
| Iowa (report) | 27 | 12.8% | https://gov.agentexchange.work/leads/expired-security-txt/state/IA.csv · card $9 |
| District of Columbia (report) | 9 | 1.0% | https://gov.agentexchange.work/leads/expired-security-txt/state/DC.csv · card $9 |
| Maryland (report) | 4 | 1.6% | https://gov.agentexchange.work/leads/expired-security-txt/state/MD.csv · card $9 |
| Virginia (report) | 3 | 1.0% | https://gov.agentexchange.work/leads/expired-security-txt/state/VA.csv · card $9 |
| Washington (report) | 3 | 1.2% | https://gov.agentexchange.work/leads/expired-security-txt/state/WA.csv · card $9 |
| Georgia (report) | 2 | 0.6% | https://gov.agentexchange.work/leads/expired-security-txt/state/GA.csv · card $9 |
| North Carolina (report) | 2 | 0.5% | https://gov.agentexchange.work/leads/expired-security-txt/state/NC.csv · card $9 |
| New Jersey (report) | 1 | 0.3% | https://gov.agentexchange.work/leads/expired-security-txt/state/NJ.csv · card $9 |
| New Mexico (report) | 1 | 0.9% | https://gov.agentexchange.work/leads/expired-security-txt/state/NM.csv · card $9 |
| New York (report) | 1 | 0.1% | https://gov.agentexchange.work/leads/expired-security-txt/state/NY.csv · card $9 |
| Ohio (report) | 1 | 0.2% | https://gov.agentexchange.work/leads/expired-security-txt/state/OH.csv · card $9 |
| Pennsylvania (report) | 1 | 0.3% | https://gov.agentexchange.work/leads/expired-security-txt/state/PA.csv · card $9 |
| Rhode Island (report) | 1 | 1.7% | https://gov.agentexchange.work/leads/expired-security-txt/state/RI.csv · card $9 |
| West Virginia (report) | 1 | 0.6% | https://gov.agentexchange.work/leads/expired-security-txt/state/WV.csv · card $9 |
Free: the first 50 of 63 (alphabetical)
| Domain | Level of government | State | Census record |
|---|---|---|---|
| anstaskforce.gov Department of the Interior | Federal - Executive | VA | HTTP 200 via www.fws.gov · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot partly blocked |
| atvsafety.gov Consumer Product Safety Commission | Federal - Executive | MD | HTTP 200 via www.cpsc.gov · HSTS yes · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked |
| boem.gov Department of the Interior | Federal - Executive | VA | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked |
| bsee.gov Department of the Interior | Federal - Executive | VA | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked |
| cpsc.gov Consumer Product Safety Commission | Federal - Executive | MD | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked |
| drywallresponse.gov Consumer Product Safety Commission | Federal - Executive | MD | HTTP 200 via www.cpsc.gov · HSTS yes · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked |
| ecpic.gov General Services Administration | Federal - Executive | DC | HTTP 200 via www.gsa.gov · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| faca.gov General Services Administration | Federal - Executive | DC | HTTP 200 via www.gsa.gov · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| fmi.gov General Services Administration | Federal - Executive | DC | HTTP 200 via www.gsa.gov · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| fws.gov Department of the Interior | Federal - Executive | DC | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot partly blocked |
| gsa.gov General Services Administration | Federal - Executive | DC | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| hanford.gov Department of Energy | Federal - Executive | WA | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility yes |
| healthfinder.gov Department of Health and Human Services | Federal - Executive | Washington | HTTP 200 via odphp.health.gov · HSTS yes · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked |
| healthypeople.gov Department of Health and Human Services | Federal - Executive | Washington | HTTP 200 via odphp.health.gov · HSTS yes · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked |
| pbrb.gov Public Buildings Reform Board | Federal - Executive | DC | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot partly blocked |
| rivers.gov Department of the Interior | Federal - Executive | DC | HTTP 200 via www.fws.gov · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| seguridadconsumidor.gov Consumer Product Safety Commission | Federal - Executive | MD | HTTP 200 via www.cpsc.gov · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot partly blocked |
| sftool.gov General Services Administration | Federal - Executive | DC | HTTP 200 via www.gsa.gov · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| usccr.gov U.S. Commission on Civil Rights | Federal - Executive | DC | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility yes |
| va.gov Department of Veterans Affairs | Federal - Executive | Washington | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot partly blocked |
| vets.gov Department of Veterans Affairs | Federal - Executive | Washington | HTTP 200 via www.va.gov · HSTS yes · security.txt expired · privacy no · accessibility no · GPTBot partly blocked |
| earnandlearniowa.gov State of Iowa - OCIO | State or territory | IA | HTTP 200 via workforce.iowa.gov · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| educateiowa.gov State of Iowa - OCIO | State or territory | IA | HTTP 200 via educate.iowa.gov · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| futurereadyiowa.gov Office of the Chief Information Officer | State or territory | IA | HTTP 200 via workforce.iowa.gov · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| ga.gov Georgia Technology Authority | State or territory | GA | HTTP 200 via georgia.gov · HSTS yes · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked |
| galaw.gov "Georgia Department of Law | State or territory | Atlanta | HTTP 200 via law.georgia.gov · HSTS yes · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked |
| gearupiowa.gov State of Iowa - OCIO | State or territory | IA | HTTP 200 via educate.iowa.gov · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| georgia.gov Georgia Technology Authority | State or territory | GA | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked |
| homebaseiowa.gov State of Iowa - OCIO | State or territory | IA | HTTP 200 via workforce.iowa.gov · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| iahealthlink.gov State of Iowa - OCIO | State or territory | IA | HTTP 200 via hhs.iowa.gov · HSTS yes · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked |
| iowa.gov State of Iowa - OCIO | State or territory | IA | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| iowacleanair.gov State of Iowa - OCIO | State or territory | IA | HTTP 200 via www.iowadnr.gov · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| iowacollegeaid.gov State of Iowa - OCIO | State or territory | IA | HTTP 200 via educate.iowa.gov · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| iowacore.gov State of Iowa - OCIO | State or territory | IA | HTTP 200 via educate.iowa.gov · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| iowaculture.gov State of Iowa - OCIO | State or territory | IA | HTTP 200 via opportunityiowa.gov · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| iowadivisionoflabor.gov State of Iowa - OCIO | State or territory | IA | HTTP 200 via dial.iowa.gov · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| iowadnr.gov State of Iowa - OCIO | State or territory | IA | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| iowadot.gov State of Iowa - OCIO | State or territory | IA | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| iowagreatplaces.gov State of Iowa - OCIO | State or territory | IA | HTTP 404 via history.iowa.gov · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| iowahumanitiescouncil.gov State of Iowa - OCIO | State or territory | IA | HTTP 200 via opportunityiowa.gov · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| iowalmi.gov Office of the Chief Information Officer | State or territory | IA | HTTP 200 via workforce.iowa.gov · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| iowaosha.gov State of Iowa - OCIO | State or territory | IA | HTTP 200 via dial.iowa.gov · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| iowasmokefreeair.gov State of Iowa - OCIO | State or territory | IA | HTTP 200 via hhs.iowa.gov · HSTS yes · security.txt expired · privacy yes · accessibility yes · GPTBot partly blocked |
| iowatitleguaranty.gov State of Iowa - OCIO | State or territory | IA | HTTP 200 via opportunityiowa.gov · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| iowawdb.gov Office of the Chief Information Officer | State or territory | IA | HTTP 200 via swdb.iowa.gov · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| iowaworkcomp.gov State of Iowa - OCIO | State or territory | IA | HTTP 200 via dial.iowa.gov · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| iowaworkforcedevelopment.gov State of Iowa - OCIO | State or territory | IA | HTTP 200 via workforce.iowa.gov · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| licensediniowa.gov State of Iowa - OCIO | State or territory | IA | HTTP 404 via www.iowa.gov · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
| njsda.gov New Jersey Schools Development Authority (NJSDA) | State or territory | NJ | HTTP 200 · HSTS yes · security.txt expired · privacy yes · accessibility yes |
| opportunityiowa.gov State of Iowa | State or territory | IA | HTTP 200 · HSTS yes · security.txt expired · privacy no · accessibility yes · GPTBot partly blocked |
The same rows as JSON: expired-security-txt.top.json (CORS open, cached one day).
Get the full list: 63 rows, 1.00 USDC
x402 on Base, paid per file, no account or key. GET https://gov.agentexchange.work/leads/expired-security-txt.csv or GET https://gov.agentexchange.work/leads/expired-security-txt.json answers 402 Payment Required with the terms (scheme exact, USDC on Base, maxAmountRequired 1000000, payTo 0xc91cE6291eDC0713ec753BAFBA002506ffb2b95c); an x402 client signs the EIP-3009 authorization and resends the same request with X-PAYMENT; the file comes back with a PAYMENT-RESPONSE header. HEAD gets the same 402. One state: GET https://gov.agentexchange.work/leads/expired-security-txt/state/<code>.csv, 0.25 USDC (codes in the table above).
curl -sS -D - https://gov.agentexchange.work/leads/expired-security-txt.csv # 402 with the x402 terms; pay and resend with X-PAYMENT
Columns (18): domain, name, type, city, state, reachable, http_only, https_status, final_host, hsts, security_txt, privacy_link, accessibility_link, robots_gptbot, robots_chatgpt_user, robots_claude_user, llms_txt, title. CSV: header row, every cell quoted, yes/no for booleans. JSON: { list, title, count, by_state, columns, rows[][] }. Sizes: CSV 15 KB, JSON 16 KB. The same facts are in the free CC BY 4.0 dumps: the price buys the filtered, state-sliceable file built from the 2026-09-30 census, not exclusive data. Settlement is final; no refunds. Prices in /.well-known/x402 equal the challenges. Terms · pricing.
Card checkout
Pay with a card through Stripe and get the file on the next page: Full list CSV, $29 · JSON, $29 · one state $9 (links in the table below) · all 8 lists, $79. Agents pay less with x402 (see above).
Monitor this list (free)
Atom feed: .gov domains that entered or left this list according to the live re-checks (every 6 hours a rotating slice, each domain at most once per 14 days; each entry says which way it moved and which field changed). expired-security-txt.top.json: the first 50 rows and the counts by state as JSON, CORS open. Fields watched: security_txt, security_txt.expired.
Membership reflects the homepage and well-known files as fetched on 2026-09-30: a control that exists but was not found where the census looked counts as missing, and sites answering 403 to our one polite request count as reachable. Every domain links to its record with what to fix, a JSON twin, a badge and a changes feed. Data licence CC BY 4.0. Not legal advice.